From bcd45cff9e750368bb8f7c2752b1df354da330e1eb77b96756ae396898f4dcf2 Mon Sep 17 00:00:00 2001 From: Heath Petersen Date: Sat, 25 Jul 2026 14:40:04 -0500 Subject: [PATCH] x --- bootstrap.yml | 428 +++++++++++++++++++++++++++----------------------- 1 file changed, 230 insertions(+), 198 deletions(-) diff --git a/bootstrap.yml b/bootstrap.yml index 2a464b5..8a1b830 100644 --- a/bootstrap.yml +++ b/bootstrap.yml @@ -25,255 +25,287 @@ #### System Software - - name: Update repositories - become: true - ansible.builtin.apt: - update_cache: true + - name: Update repositories + become: true + ansible.builtin.apt: + update_cache: true - - name: Install bootstrap packages - become: true - ansible.builtin.apt: - state: present - pkg: - - bash - - curl - - python3 - - python3-pip - - python3-venv - - python3-virtualenv + - name: Install bootstrap packages + become: true + ansible.builtin.apt: + state: present + pkg: + - bash + - curl + - python3 + - python3-pip + - python3-venv + - python3-virtualenv #### Configure sudo - - name: Create system group hpf-sudo for normal sudo users - become: true - ansible.builtin.group: - name: hpf-sudo - state: present - system: true - gid: 700 + - name: Create system group hpf-sudo for normal sudo users + become: true + ansible.builtin.group: + name: hpf-sudo + state: present + system: true + gid: 700 - - name: Create system group hpf-sudo-np for special sudo users that don't require a password - become: true - ansible.builtin.group: - name: hpf-sudo-np - state: present - system: true - gid: 701 + - name: Create system group hpf-sudo-np for special sudo users that don't require a password + become: true + ansible.builtin.group: + name: hpf-sudo-np + state: present + system: true + gid: 701 - - name: Make sure /etc/sudoers.d exists - become: true - ansible.builtin.file: - path: /etc/sudoers.d - state: directory - owner: root - group: root - mode: u=rwx,go= + - name: Make sure /etc/sudoers.d exists + become: true + ansible.builtin.file: + path: /etc/sudoers.d + state: directory + owner: root + group: root + mode: u=rwx,go= - - name: Get /etc/sudoers.d/hpf - become: true - ansible.builtin.copy: - src: etc/sudoers.d/hpf - dest: /etc/sudoers.d/hpf - owner: root - group: root - mode: u=rw,go= - backup: true - validate: /usr/sbin/visudo -csf %s + - name: Get /etc/sudoers.d/hpf + become: true + ansible.builtin.copy: + src: etc/sudoers.d/hpf + dest: /etc/sudoers.d/hpf + owner: root + group: root + mode: u=rw,go= + backup: true + validate: /usr/sbin/visudo -csf %s #### Configure sshd - - name: Make sure /etc/ssh/sshd_config.d exists - become: true - ansible.builtin.file: - path: /etc/ssh/sshd_config.d - state: directory - owner: root - group: root - mode: u=rwx,go=rx + - name: Make sure /etc/ssh/sshd_config.d exists + become: true + ansible.builtin.file: + path: /etc/ssh/sshd_config.d + state: directory + owner: root + group: root + mode: u=rwx,go=rx - - name: Get /etc/ssh/sshd_config.d/hpf.conf - become: true - ansible.builtin.copy: - src: etc/ssh/sshd_config.d/hpf.conf - dest: /etc/ssh/sshd_config.d/hpf.conf - owner: root - group: root - mode: u=rwx,go=rx - backup: true - validate: /usr/sbin/sshd -t -f %s - notify: Restart sshd + - name: Get /etc/ssh/sshd_config.d/hpf.conf + become: true + ansible.builtin.copy: + src: etc/ssh/sshd_config.d/hpf.conf + dest: /etc/ssh/sshd_config.d/hpf.conf + owner: root + group: root + mode: u=rwx,go=rx + backup: true + validate: /usr/sbin/sshd -t -f %s + notify: Restart sshd #### Configure /etc/skel - - name: Make sure /etc/skel/.profile.d exists - become: true - ansible.builtin.file: - path: /etc/skel/.profile.d - state: directory - owner: root - group: root - mode: u=rwx,go= + - name: Make sure /etc/skel/.profile.d exists + become: true + ansible.builtin.file: + path: /etc/skel/.profile.d + state: directory + owner: root + group: root + mode: u=rwx,go= - - name: Get /etc/skel/.profile.d/ansible-venv.sh - become: true - ansible.builtin.copy: - src: etc/skel/.profile.d/ansible-venv.sh - dest: /etc/skel/.profile.d/ansible-venv.sh - owner: root - group: root - mode: u=rw,go= - backup: true + - name: Get /etc/skel/.profile.d/ansible-venv.sh + become: true + ansible.builtin.copy: + src: etc/skel/.profile.d/ansible-venv.sh + dest: /etc/skel/.profile.d/ansible-venv.sh + owner: root + group: root + mode: u=rw,go= + backup: true - - name: Get /etc/skel/.profile - become: true - ansible.builtin.copy: - src: etc/skel/.profile - dest: /etc/skel/.profile - owner: root - group: root - mode: u=rw,go= - backup: true + - name: Get /etc/skel/.profile + become: true + ansible.builtin.copy: + src: etc/skel/.profile + dest: /etc/skel/.profile + owner: root + group: root + mode: u=rw,go= + backup: true #### User: root - - name: Set root's authorized_keys - become: true - ansible.posix.authorized_key: - user: root - state: present - key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}" + - name: Set root's authorized_keys + become: true + ansible.posix.authorized_key: + user: root + state: present + key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}" #### User: hpf-ans - - name: Create the hpf-ans group - become: true - ansible.builtin.group: - name: hpf-ans - state: present - system: true - gid: 800 + - name: Create the hpf-ans group + become: true + ansible.builtin.group: + name: hpf-ans + state: present + system: true + gid: 800 - - name: Create the hpf-ans user - become: true - ansible.builtin.user: - name: hpf-ans - state: present - system: true - uid: 800 - group: hpf-ans - groups: hpf-sudo-np - append: true - create_home: true - shell: /usr/bin/bash + - name: Create the hpf-ans user + become: true + ansible.builtin.user: + name: hpf-ans + state: present + system: true + uid: 800 + group: hpf-ans + groups: hpf-sudo-np + append: true + create_home: true + shell: /usr/bin/bash - - name: Set hpf-ans's authorized_keys - become: true - ansible.posix.authorized_key: - user: hpf-ans - state: present - key: "{{ lookup('file', item) }}" - loop: - - files/ssh-keys/hpf-ans.pub - - files/ssh-keys/heath.pub + - name: Set hpf-ans's authorized_keys + become: true + ansible.posix.authorized_key: + user: hpf-ans + state: present + key: "{{ lookup('file', item) }}" + loop: + - files/ssh-keys/hpf-ans.pub + - files/ssh-keys/heath.pub - - name: Make sure pip is up to date - become: true - become_user: hpf-ans - ansible.builtin.pip: - name: pip - virtualenv: $HOME/.ansible-venv - extra_args: --upgrade + - name: Make sure pip is up to date + become: true + become_user: hpf-ans + ansible.builtin.pip: + name: pip + virtualenv: $HOME/.ansible-venv + extra_args: --upgrade - - name: Make sure ansible is up to date - become: true - become_user: hpf-ans - ansible.builtin.pip: - name: ansible - virtualenv: $HOME/.ansible-venv - extra_args: --upgrade + - name: Make sure ansible is up to date + become: true + become_user: hpf-ans + ansible.builtin.pip: + name: ansible + virtualenv: $HOME/.ansible-venv + extra_args: --upgrade - - name: Make sure /home/hpf-ans/bin exists - become: true - become_user: hpf-ans - ansible.builtin.file: - path: $HOME/bin - state: directory - owner: hpf-ans - group: hpf-ans - mode: u=rwx,go= + - name: Make sure /home/hpf-ans/bin exists + become: true + become_user: hpf-ans + ansible.builtin.file: + path: $HOME/bin + state: directory + owner: hpf-ans + group: hpf-ans + mode: u=rwx,go= - - name: Get /home/hpf-ans/bin/ansible-pull.sh - become: true - become_user: hpf-ans - ansible.builtin.copy: - src: home/hpf-ans/bin/ansible-pull.sh - dest: $HOME/bin/ansible-pull.sh - owner: hpf-ans - group: hpf-ans - mode: u=rwx,go= - backup: true + - name: Get /home/hpf-ans/bin/ansible-pull.sh + become: true + become_user: hpf-ans + ansible.builtin.copy: + src: home/hpf-ans/bin/ansible-pull.sh + dest: $HOME/bin/ansible-pull.sh + owner: hpf-ans + group: hpf-ans + mode: u=rwx,go= + backup: true #### User: first - - name: Set first's authorized_keys - become: true - ansible.posix.authorized_key: - user: first - state: present - key: "{{ lookup('file', item) }}" - loop: - - files/ssh-keys/first.pub - - files/ssh-keys/heath.pub +# - name: Create the first user +# become: true +# ansible.builtin.user: +# name: first +# comment: First User +# state: present +# system: false +# create_home: true +# shell: /usr/bin/bash + +# - name: Set first's authorized_keys +# become: true +# ansible.posix.authorized_key: +# user: first +# state: present +# key: "{{ lookup('file', item) }}" +# loop: +# - files/ssh-keys/first.pub +# - files/ssh-keys/heath.pub #### User: heath - - name: Set heath's authorized_keys - become: true - ansible.posix.authorized_key: - user: heath - state: present - key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}" +# - name: Create the heath group +# become: true +# ansible.builtin.group: +# name: heath +# state: present +# system: false +# gid: 8000 + +# - name: Create the heath user +# become: true +# ansible.builtin.user: +# name: heath +# comment: Heath Petersen +# state: present +# system: false +# uid: 8000 +# group: heath +# groups: hpf-sudo +# append: true +# create_home: true +# shell: /usr/bin/bash + + - name: Set heath's authorized_keys + become: true + ansible.posix.authorized_key: + user: heath + state: present + key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}" #### Schedule ansible-pull.sh - - name: Make sure log directory exists - become: true - ansible.builtin.file: - path: /var/log/ansible-pull.sh - state: directory - owner: hpf-ans - group: root - mode: u=rwx,go= + - name: Make sure log directory exists + become: true + ansible.builtin.file: + path: /var/log/ansible-pull.sh + state: directory + owner: hpf-ans + group: root + mode: u=rwx,go= -# - name: Create ansible-pull.sh crontab entry -# become: true -# ansible.builtin.cron: -# name: "ansible-pull" -# minute: "*/27" -# job: $HOME/bin/ansible-pull.sh -# backup: true +# - name: Create ansible-pull.sh crontab entry +# become: true +# ansible.builtin.cron: +# name: "ansible-pull" +# minute: "*/27" +# job: $HOME/bin/ansible-pull.sh +# backup: true #### Clean System Software - - name: Remove packages installed as dependencies that are no longer required and purge their configuration files - become: true - ansible.builtin.apt: - autoremove: true - purge: true + - name: Remove packages installed as dependencies that are no longer required and purge their configuration files + become: true + ansible.builtin.apt: + autoremove: true + purge: true - - name: Remove old downloaded packages - become: true - ansible.builtin.apt: - autoclean: true + - name: Remove old downloaded packages + become: true + ansible.builtin.apt: + autoclean: true #### Handlers