heath/ansible
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x

Browse Source
This commit is contained in:
Heath Petersen
2026-07-25 14:40:04 -05:00
parent 0e820b49f9
commit bcd45cff9e
1 changed files with 230 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap.yml
+230 -198
View File
@@ -25,255 +25,287 @@
#### System Software #### System Software
- name: Update repositories - name: Update repositories
become: true become: true
ansible.builtin.apt: ansible.builtin.apt:
update_cache: true update_cache: true
- name: Install bootstrap packages - name: Install bootstrap packages
become: true become: true
ansible.builtin.apt: ansible.builtin.apt:
state: present state: present
pkg: pkg:
- bash - bash
- curl - curl
- python3 - python3
- python3-pip - python3-pip
- python3-venv - python3-venv
- python3-virtualenv - python3-virtualenv
#### Configure sudo #### Configure sudo
- name: Create system group hpf-sudo for normal sudo users - name: Create system group hpf-sudo for normal sudo users
become: true become: true
ansible.builtin.group: ansible.builtin.group:
name: hpf-sudo name: hpf-sudo
state: present state: present
system: true system: true
gid: 700 gid: 700
- name: Create system group hpf-sudo-np for special sudo users that don't require a password - name: Create system group hpf-sudo-np for special sudo users that don't require a password
become: true become: true
ansible.builtin.group: ansible.builtin.group:
name: hpf-sudo-np name: hpf-sudo-np
state: present state: present
system: true system: true
gid: 701 gid: 701
- name: Make sure /etc/sudoers.d exists - name: Make sure /etc/sudoers.d exists
become: true become: true
ansible.builtin.file: ansible.builtin.file:
path: /etc/sudoers.d path: /etc/sudoers.d
state: directory state: directory
owner: root owner: root
group: root group: root
mode: u=rwx,go= mode: u=rwx,go=
- name: Get /etc/sudoers.d/hpf - name: Get /etc/sudoers.d/hpf
become: true become: true
ansible.builtin.copy: ansible.builtin.copy:
src: etc/sudoers.d/hpf src: etc/sudoers.d/hpf
dest: /etc/sudoers.d/hpf dest: /etc/sudoers.d/hpf
owner: root owner: root
group: root group: root
mode: u=rw,go= mode: u=rw,go=
backup: true backup: true
validate: /usr/sbin/visudo -csf %s validate: /usr/sbin/visudo -csf %s
#### Configure sshd #### Configure sshd
- name: Make sure /etc/ssh/sshd_config.d exists - name: Make sure /etc/ssh/sshd_config.d exists
become: true become: true
ansible.builtin.file: ansible.builtin.file:
path: /etc/ssh/sshd_config.d path: /etc/ssh/sshd_config.d
state: directory state: directory
owner: root owner: root
group: root group: root
mode: u=rwx,go=rx mode: u=rwx,go=rx
- name: Get /etc/ssh/sshd_config.d/hpf.conf - name: Get /etc/ssh/sshd_config.d/hpf.conf
become: true become: true
ansible.builtin.copy: ansible.builtin.copy:
src: etc/ssh/sshd_config.d/hpf.conf src: etc/ssh/sshd_config.d/hpf.conf
dest: /etc/ssh/sshd_config.d/hpf.conf dest: /etc/ssh/sshd_config.d/hpf.conf
owner: root owner: root
group: root group: root
mode: u=rwx,go=rx mode: u=rwx,go=rx
backup: true backup: true
validate: /usr/sbin/sshd -t -f %s validate: /usr/sbin/sshd -t -f %s
notify: Restart sshd notify: Restart sshd
#### Configure /etc/skel #### Configure /etc/skel
- name: Make sure /etc/skel/.profile.d exists - name: Make sure /etc/skel/.profile.d exists
become: true become: true
ansible.builtin.file: ansible.builtin.file:
path: /etc/skel/.profile.d path: /etc/skel/.profile.d
state: directory state: directory
owner: root owner: root
group: root group: root
mode: u=rwx,go= mode: u=rwx,go=
- name: Get /etc/skel/.profile.d/ansible-venv.sh - name: Get /etc/skel/.profile.d/ansible-venv.sh
become: true become: true
ansible.builtin.copy: ansible.builtin.copy:
src: etc/skel/.profile.d/ansible-venv.sh src: etc/skel/.profile.d/ansible-venv.sh
dest: /etc/skel/.profile.d/ansible-venv.sh dest: /etc/skel/.profile.d/ansible-venv.sh
owner: root owner: root
group: root group: root
mode: u=rw,go= mode: u=rw,go=
backup: true backup: true
- name: Get /etc/skel/.profile - name: Get /etc/skel/.profile
become: true become: true
ansible.builtin.copy: ansible.builtin.copy:
src: etc/skel/.profile src: etc/skel/.profile
dest: /etc/skel/.profile dest: /etc/skel/.profile
owner: root owner: root
group: root group: root
mode: u=rw,go= mode: u=rw,go=
backup: true backup: true
#### User: root #### User: root
- name: Set root's authorized_keys - name: Set root's authorized_keys
become: true become: true
ansible.posix.authorized_key: ansible.posix.authorized_key:
user: root user: root
state: present state: present
key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}" key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"
#### User: hpf-ans #### User: hpf-ans
- name: Create the hpf-ans group - name: Create the hpf-ans group
become: true become: true
ansible.builtin.group: ansible.builtin.group:
name: hpf-ans name: hpf-ans
state: present state: present
system: true system: true
gid: 800 gid: 800
- name: Create the hpf-ans user - name: Create the hpf-ans user
become: true become: true
ansible.builtin.user: ansible.builtin.user:
name: hpf-ans name: hpf-ans
state: present state: present
system: true system: true
uid: 800 uid: 800
group: hpf-ans group: hpf-ans
groups: hpf-sudo-np groups: hpf-sudo-np
append: true append: true
create_home: true create_home: true
shell: /usr/bin/bash shell: /usr/bin/bash
- name: Set hpf-ans's authorized_keys - name: Set hpf-ans's authorized_keys
become: true become: true
ansible.posix.authorized_key: ansible.posix.authorized_key:
user: hpf-ans user: hpf-ans
state: present state: present
key: "{{ lookup('file', item) }}" key: "{{ lookup('file', item) }}"
loop: loop:
- files/ssh-keys/hpf-ans.pub - files/ssh-keys/hpf-ans.pub
- files/ssh-keys/heath.pub - files/ssh-keys/heath.pub
- name: Make sure pip is up to date - name: Make sure pip is up to date
become: true become: true
become_user: hpf-ans become_user: hpf-ans
ansible.builtin.pip: ansible.builtin.pip:
name: pip name: pip
virtualenv: $HOME/.ansible-venv virtualenv: $HOME/.ansible-venv
extra_args: --upgrade extra_args: --upgrade
- name: Make sure ansible is up to date - name: Make sure ansible is up to date
become: true become: true
become_user: hpf-ans become_user: hpf-ans
ansible.builtin.pip: ansible.builtin.pip:
name: ansible name: ansible
virtualenv: $HOME/.ansible-venv virtualenv: $HOME/.ansible-venv
extra_args: --upgrade extra_args: --upgrade
- name: Make sure /home/hpf-ans/bin exists - name: Make sure /home/hpf-ans/bin exists
become: true become: true
become_user: hpf-ans become_user: hpf-ans
ansible.builtin.file: ansible.builtin.file:
path: $HOME/bin path: $HOME/bin
state: directory state: directory
owner: hpf-ans owner: hpf-ans
group: hpf-ans group: hpf-ans
mode: u=rwx,go= mode: u=rwx,go=
- name: Get /home/hpf-ans/bin/ansible-pull.sh - name: Get /home/hpf-ans/bin/ansible-pull.sh
become: true become: true
become_user: hpf-ans become_user: hpf-ans
ansible.builtin.copy: ansible.builtin.copy:
src: home/hpf-ans/bin/ansible-pull.sh src: home/hpf-ans/bin/ansible-pull.sh
dest: $HOME/bin/ansible-pull.sh dest: $HOME/bin/ansible-pull.sh
owner: hpf-ans owner: hpf-ans
group: hpf-ans group: hpf-ans
mode: u=rwx,go= mode: u=rwx,go=
backup: true backup: true
#### User: first #### User: first
- name: Set first's authorized_keys # - name: Create the first user
become: true # become: true
ansible.posix.authorized_key: # ansible.builtin.user:
user: first # name: first
state: present # comment: First User
key: "{{ lookup('file', item) }}" # state: present
loop: # system: false
- files/ssh-keys/first.pub # create_home: true
- files/ssh-keys/heath.pub # shell: /usr/bin/bash
# - name: Set first's authorized_keys
# become: true
# ansible.posix.authorized_key:
# user: first
# state: present
# key: "{{ lookup('file', item) }}"
# loop:
# - files/ssh-keys/first.pub
# - files/ssh-keys/heath.pub
#### User: heath #### User: heath
- name: Set heath's authorized_keys # - name: Create the heath group
become: true # become: true
ansible.posix.authorized_key: # ansible.builtin.group:
user: heath # name: heath
state: present # state: present
key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}" # system: false
# gid: 8000
# - name: Create the heath user
# become: true
# ansible.builtin.user:
# name: heath
# comment: Heath Petersen
# state: present
# system: false
# uid: 8000
# group: heath
# groups: hpf-sudo
# append: true
# create_home: true
# shell: /usr/bin/bash
- name: Set heath's authorized_keys
become: true
ansible.posix.authorized_key:
user: heath
state: present
key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"
#### Schedule ansible-pull.sh #### Schedule ansible-pull.sh
- name: Make sure log directory exists - name: Make sure log directory exists
become: true become: true
ansible.builtin.file: ansible.builtin.file:
path: /var/log/ansible-pull.sh path: /var/log/ansible-pull.sh
state: directory state: directory
owner: hpf-ans owner: hpf-ans
group: root group: root
mode: u=rwx,go= mode: u=rwx,go=
# - name: Create ansible-pull.sh crontab entry # - name: Create ansible-pull.sh crontab entry
# become: true # become: true
# ansible.builtin.cron: # ansible.builtin.cron:
# name: "ansible-pull" # name: "ansible-pull"
# minute: "*/27" # minute: "*/27"
# job: $HOME/bin/ansible-pull.sh # job: $HOME/bin/ansible-pull.sh
# backup: true # backup: true
#### Clean System Software #### Clean System Software
- name: Remove packages installed as dependencies that are no longer required and purge their configuration files - name: Remove packages installed as dependencies that are no longer required and purge their configuration files
become: true become: true
ansible.builtin.apt: ansible.builtin.apt:
autoremove: true autoremove: true
purge: true purge: true
- name: Remove old downloaded packages - name: Remove old downloaded packages
become: true become: true
ansible.builtin.apt: ansible.builtin.apt:
autoclean: true autoclean: true
#### Handlers #### Handlers