ansible/bootstrap.yml

---

####
#### WARNING:
####
####     bootstrap.sh and bootstrap.yml should be updated together.  They should do the
####     exact same things with the following exceptions:
####
####         * bootstrap.sh
####           - at the end it should run ansible-pull.sh against bootstrap.yml
####
####         * bootstrap.yml
####           - at the end it should configure cron to schedule ansible-pull.sh
####
####     !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
####     ! Make sure to keep them in sync !
####     !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
####

- name: Bootstrap playbook
  hosts: all

  tasks:


#### System Software

    - name: Update repositories
      become: true
      ansible.builtin.apt:
        update_cache: true

    - name: Install bootstrap packages
      become: true
      ansible.builtin.apt:
        state: present
        pkg:
          - bash
          - curl
          - python3
          - python3-pip
          - python3-venv
          - python3-virtualenv


#### Configure sudo

    - name: Create system group hpf-sudo for normal sudo users
      become: true
      ansible.builtin.group:
        name: hpf-sudo
        state: present
        system: true
        gid: 700

    - name: Create system group hpf-sudo-np for special sudo users that don't require a password
      become: true
      ansible.builtin.group:
        name: hpf-sudo-np
        state: present
        system: true
        gid: 701

    - name: Make sure /etc/sudoers.d exists
      become: true
      ansible.builtin.file:
        path: /etc/sudoers.d
        state: directory
        owner: root
        group: root
        mode: u=rwx,go=

    - name: Get /etc/sudoers.d/hpf
      become: true
      ansible.builtin.copy:
        src: etc/sudoers.d/hpf
        dest: /etc/sudoers.d/hpf
        owner: root
        group: root
        mode: u=rw,go=
        backup: true
        validate: /usr/sbin/visudo -csf %s


#### Configure sshd

    - name: Make sure /etc/ssh/sshd_config.d exists
      become: true
      ansible.builtin.file:
        path: /etc/ssh/sshd_config.d
        state: directory
        owner: root
        group: root
        mode: u=rwx,go=rx

    - name: Get /etc/ssh/sshd_config.d/hpf.conf
      become: true
      ansible.builtin.copy:
        src: etc/ssh/sshd_config.d/hpf.conf
        dest: /etc/ssh/sshd_config.d/hpf.conf
        owner: root
        group: root
        mode: u=rwx,go=rx
        backup: true
        validate: /usr/sbin/sshd -t -f %s
      notify: Restart sshd


#### Configure /etc/skel

    - name: Make sure /etc/skel/.profile.d exists
      become: true
      ansible.builtin.file:
        path: /etc/skel/.profile.d
        state: directory
        owner: root
        group: root
        mode: u=rwx,go=

    - name: Get /etc/skel/.profile.d/ansible-venv.sh
      become: true
      ansible.builtin.copy:
        src: etc/skel/.profile.d/ansible-venv.sh
        dest: /etc/skel/.profile.d/ansible-venv.sh
        owner: root
        group: root
        mode: u=rw,go=
        backup: true

    - name: Get /etc/skel/.profile
      become: true
      ansible.builtin.copy:
        src: etc/skel/.profile
        dest: /etc/skel/.profile
        owner: root
        group: root
        mode: u=rw,go=
        backup: true


#### User: root

    - name: Set root's authorized_keys
      become: true
      ansible.posix.authorized_key:
        user: root
        state: present
        key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"


#### User: hpf-ans

    - name: Create the hpf-ans group
      become: true
      ansible.builtin.group:
        name: hpf-ans
        state: present
        system: true
        gid: 800

    - name: Create the hpf-ans user
      become: true
      ansible.builtin.user:
        name: hpf-ans
        state: present
        system: true
        uid: 800
        group: hpf-ans
        groups: hpf-sudo-np
        append: true
        create_home: true
        shell: /usr/bin/bash

    - name: Set hpf-ans's authorized_keys
      become: true
      ansible.posix.authorized_key:
        user: hpf-ans
        state: present
        key: "{{ lookup('file', item) }}"
      loop:
        - files/ssh-keys/hpf-ans.pub
        - files/ssh-keys/heath.pub

    - name: Make sure pip is up to date
      become: true
      become_user: hpf-ans
      ansible.builtin.pip:
        name: pip
        virtualenv: $HOME/.ansible-venv
        extra_args: --upgrade

    - name: Make sure ansible is up to date
      become: true
      become_user: hpf-ans
      ansible.builtin.pip:
        name: ansible
        virtualenv: $HOME/.ansible-venv
        extra_args: --upgrade

    - name: Make sure /home/hpf-ans/bin exists
      become: true
      become_user: hpf-ans
      ansible.builtin.file:
        path: $HOME/bin
        state: directory
        owner: hpf-ans
        group: hpf-ans
        mode: u=rwx,go=

    - name: Get /home/hpf-ans/bin/ansible-pull.sh
      become: true
      become_user: hpf-ans
      ansible.builtin.copy:
        src: home/hpf-ans/bin/ansible-pull.sh
        dest: $HOME/bin/ansible-pull.sh
        owner: hpf-ans
        group: hpf-ans
        mode: u=rwx,go=
        backup: true


#### User: first

    - name: Create the first user
      become: true
      ansible.builtin.user:
        name: first
        comment: First User
        state: present
        system: false
        groups: hpf-sudo-np
        append: true
        create_home: true
        shell: /usr/bin/bash
        uid_max: 1000

    - name: Set first's authorized_keys
      become: true
      ansible.posix.authorized_key:
        user: first
        state: present
        key: "{{ lookup('file', item) }}"
      loop:
        - files/ssh-keys/first.pub
        - files/ssh-keys/heath.pub


#### User: heath

    - name: Create the heath group
      become: true
      ansible.builtin.group:
        name: heath
        state: present
        system: false
        gid: 60001

    - name: Create the heath user
      become: true
      ansible.builtin.user:
        name: heath
        comment: Heath Petersen
        state: present
        system: false
        uid: 60001
        group: heath
        groups: hpf-sudo
        append: true
        create_home: true
        shell: /usr/bin/bash

    - name: Set heath's authorized_keys
      become: true
      ansible.posix.authorized_key:
        user: heath
        state: present
        key: "{{ lookup('file', 'files/ssh-keys/heath.pub') }}"


#### Schedule ansible-pull.sh

    - name: Make sure log directory exists
      become: true
      ansible.builtin.file:
        path: /var/log/ansible-pull.sh
        state: directory
        owner: hpf-ans
        group: root
        mode: u=rwx,go=

#   - name: Create ansible-pull.sh crontab entry
#     become: true
#     ansible.builtin.cron:
#       name: "ansible-pull"
#       minute: "*/27"
#       job: $HOME/bin/ansible-pull.sh
#       backup: true


#### Clean System Software

    - name: Remove packages installed as dependencies that are no longer required and purge their configuration files
      become: true
      ansible.builtin.apt:
        autoremove: true
        purge: true

    - name: Remove old downloaded packages
      become: true
      ansible.builtin.apt:
        autoclean: true


#### Handlers

  handlers:

    - name: Restart sshd
      become: true
      ansible.builtin.service:
        name: sshd
        state: restarted