ansible/bootstrap.yml

---

####
#### WARNING:
####
####     bootstrap.sh and bootstrap.yml should be updated together.  They should do the
####     exact same things with the following exceptions:
####
####         * bootstrap.sh
####           - at the end it should run ansible-pull.sh against bootstrap.yml
####
####         * bootstrap.yml
####           - at the end it should configure cron to schedule ansible-pull.sh
####
####     !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
####     ! Make sure to keep them in sync !
####     !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
####

- name: Bootstrap playbook
  hosts: all

  tasks:


#### System Software

  - name: Update repositories
    become: true
    ansible.builtin.apt:
      update_cache: true

  - name: Install bootstrap packages
    become: true
    ansible.builtin.apt:
      state: present
      pkg:
        - bash
        - curl
        - python3
        - python3-pip
        - python3-venv
        - python3-virtualenv


#### Configure sudo

  - name: Create system group hpf-sudo for normal sudo users
    become: true
    ansible.builtin.group:
      name: hpf-sudo
      state: present
      system: true
      gid: 700

  - name: Create system group hpf-sudo-np for special sudo users that don't require a password
    become: true
    ansible.builtin.group:
      name: hpf-sudo-np
      state: present
      system: true
      gid: 701

  - name: Make sure /etc/sudoers.d exists
    become: true
    ansible.builtin.file:
      path: /etc/sudoers.d
      state: directory
      owner: root
      group: root
      mode: u=rwx,go=

  - name: Get /etc/sudoers.d/hpf
    become: true
    ansible.builtin.copy:
      src: etc/sudoers.d/hpf
      dest: /etc/sudoers.d/hpf
      owner: root
      group: root
      mode: u=rw,go=
      backup: true
      validate: /usr/sbin/visudo -csf %s


#### Configure sshd

  - name: Make sure /etc/ssh/sshd_config.d exists
    become: true
    ansible.builtin.file:
      path: /etc/ssh/sshd_config.d
      state: directory
      owner: root
      group: root
      mode: u=rwx,go=rx

  - name: Get /etc/ssh/sshd_config.d/hpf.conf
    become: true
    ansible.builtin.copy:
      src: etc/ssh/sshd_config.d/hpf.conf
      dest: /etc/ssh/sshd_config.d/hpf.conf
      owner: root
      group: root
      mode: u=rwx,go=rx
      backup: true
      validate: /usr/sbin/sshd -t -f %s
    notify: Restart sshd


#### Configure /etc/skel

  - name: Make sure /etc/skel/.profile.d exists
    become: true
    ansible.builtin.file:
      path: /etc/skel/.profile.d
      state: directory
      owner: root
      group: root
      mode: u=rwx,go=

  - name: Get /etc/skel/.profile.d/ansible-venv.sh
    become: true
    ansible.builtin.copy:
      src: etc/skel/.profile.d/ansible-venv.sh
      dest: /etc/skel/.profile.d/ansible-venv.sh
      owner: root
      group: root
      mode: u=rw,go=
      backup: true

  - name: Get /etc/skel/.profile
    become: true
    ansible.builtin.copy:
      src: etc/skel/.profile
      dest: /etc/skel/.profile
      owner: root
      group: root
      mode: u=rw,go=
      backup: true


#### User: root

  - name: Set root's authorized_keys
    become: true
    ansible.posix.authorized_key:
      user: root
      state: present
      key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"


#### User: hpf-ans

  - name: Create the hpf-ans group
    become: true
    ansible.builtin.group:
      name: hpf-ans
      state: present
      system: true
      gid: 800

  - name: Create the hpf-ans user
    become: true
    ansible.builtin.user:
      name: hpf-ans
      state: present
      system: true
      uid: 800
      group: hpf-ans
      groups: hpf-sudo-np
      append: true
      create_home: true
      shell: /usr/bin/bash

  - name: Set hpf-ans's authorized_keys
    become: true
    ansible.posix.authorized_key:
      user: hpf-ans
      state: present
      key: "{{ lookup('file', item) }}"
    loop:
      - files/ssh-keys/hpf-ans.pub
      - files/ssh-keys/heath.pub

  - name: Make sure pip is up to date
    become: true
    become_user: hpf-ans
    ansible.builtin.pip:
      name: pip
      virtualenv: $HOME/.ansible-venv
      extra_args: --upgrade

  - name: Make sure ansible is up to date
    become: true
    become_user: hpf-ans
    ansible.builtin.pip:
      name: ansible
      virtualenv: $HOME/.ansible-venv
      extra_args: --upgrade

  - name: Make sure /home/hpf-ans/bin exists
    become: true
    become_user: hpf-ans
    ansible.builtin.file:
      path: $HOME/bin
      state: directory
      owner: hpf-ans
      group: hpf-ans
      mode: u=rwx,go=

  - name: Get /home/hpf-ans/bin/ansible-pull.sh
    become: true
    become_user: hpf-ans
    ansible.builtin.copy:
      src: home/hpf-ans/bin/ansible-pull.sh
      dest: $HOME/bin/ansible-pull.sh
      owner: hpf-ans
      group: hpf-ans
      mode: u=rwx,go=
      backup: true


#### User: first

  - name: Set first's authorized_keys
    become: true
    ansible.posix.authorized_key:
      user: first
      state: present
      key: "{{ lookup('file', item) }}"
    loop:
      - files/ssh-keys/first.pub
      - files/ssh-keys/heath.pub


#### User: heath

  - name: Set heath's authorized_keys
    become: true
    ansible.posix.authorized_key:
      user: heath
      state: present
      key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"


#### Schedule ansible-pull.sh

  - name: Make sure log directory exists
    become: true
    ansible.builtin.file:
      path: /var/log/ansible-pull.sh
      state: directory
      owner: hpf-ans
      group: root
      mode: u=rwx,go=

# - name: Create ansible-pull.sh crontab entry
#   become: true
#   ansible.builtin.cron:
#     name: "ansible-pull"
#     minute: "*/27"
#     job: $HOME/bin/ansible-pull.sh
#     backup: true


#### Clean System Software

  - name: Remove packages installed as dependencies that are no longer required and purge their configuration files
    become: true
    ansible.builtin.apt:
      autoremove: true
      purge: true

  - name: Remove old downloaded packages
    become: true
    ansible.builtin.apt:
      autoclean: true


#### Handlers

  handlers:

    - name: Restart sshd
      become: true
      ansible.builtin.service:
        name: sshd
        state: restarted