395 lines
9.1 KiB
YAML
395 lines
9.1 KiB
YAML
---
|
|
- name: Bootstrap playbook
|
|
hosts: all
|
|
|
|
tasks:
|
|
|
|
|
|
#### System Software
|
|
|
|
- name: Update repositories
|
|
become: true
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
|
|
- name: Install bootstrap packages
|
|
become: true
|
|
ansible.builtin.apt:
|
|
state: present
|
|
pkg:
|
|
- bash
|
|
- python3
|
|
- python3-pip
|
|
- python3-venv
|
|
- python3-virtualenv
|
|
- logrotate
|
|
|
|
|
|
#### Configure sudo
|
|
|
|
- name: Create system group hpf-sudo for normal sudo users
|
|
become: true
|
|
ansible.builtin.group:
|
|
name: hpf-sudo
|
|
state: present
|
|
system: true
|
|
gid: 700
|
|
|
|
- name: Create system group hpf-sudo-np for special sudo users that don't require a password
|
|
become: true
|
|
ansible.builtin.group:
|
|
name: hpf-sudo-np
|
|
state: present
|
|
system: true
|
|
gid: 701
|
|
|
|
# - name: Make sure /etc/sudoers.d exists
|
|
# become: true
|
|
# ansible.builtin.file:
|
|
# path: /etc/sudoers.d
|
|
# state: directory
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rwx,go=
|
|
|
|
# - name: Get /etc/sudoers.d/hpf
|
|
# become: true
|
|
# ansible.builtin.copy:
|
|
# src: etc/sudoers.d/hpf
|
|
# dest: /etc/sudoers.d/hpf
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rw,go=
|
|
# backup: true
|
|
# validate: /usr/sbin/visudo -csf %s
|
|
|
|
- name: Get /etc/sudoers.d
|
|
become: true
|
|
ansible.builtin.copy:
|
|
src: etc/sudoers.d
|
|
dest: /etc/
|
|
owner: root
|
|
group: root
|
|
directory_mode: u=rwx,go=
|
|
mode: u=rw,g=r,o=
|
|
backup: true
|
|
validate: /usr/sbin/visudo -csf %s
|
|
|
|
#### Configure sshd
|
|
|
|
# - name: Make sure /etc/ssh/sshd_config.d exists
|
|
# become: true
|
|
# ansible.builtin.file:
|
|
# path: /etc/ssh/sshd_config.d
|
|
# state: directory
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rwx,go=rx
|
|
#
|
|
# - name: Get /etc/ssh/sshd_config.d/hpf.conf
|
|
# become: true
|
|
# ansible.builtin.copy:
|
|
# src: etc/ssh/sshd_config.d/hpf.conf
|
|
# dest: /etc/ssh/sshd_config.d/hpf.conf
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rwx,go=rx
|
|
# backup: true
|
|
# validate: /usr/sbin/sshd -t -f %s
|
|
# notify: Restart sshd
|
|
|
|
- name: Get /etc/ssh/sshd_config.d
|
|
become: true
|
|
ansible.builtin.copy:
|
|
src: etc/ssh/sshd_config.d
|
|
dest: /etc/ssh/
|
|
owner: root
|
|
group: root
|
|
directory_mode: u=rwx,go=rx
|
|
mode: u=rw,go=r
|
|
backup: true
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
notify: Restart sshd
|
|
|
|
#### Configure /etc/skel
|
|
|
|
# - name: Make sure /etc/skel/.profile.d exists
|
|
# become: true
|
|
# ansible.builtin.file:
|
|
# path: /etc/skel/.profile.d
|
|
# state: directory
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rwx,go=
|
|
|
|
# - name: Get /etc/skel/.profile.d/ansible-venv.sh
|
|
# become: true
|
|
# ansible.builtin.copy:
|
|
# src: etc/skel/.profile.d/ansible-venv.sh
|
|
# dest: /etc/skel/.profile.d/ansible-venv.sh
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rw,go=
|
|
# backup: true
|
|
|
|
# - name: Get /etc/skel/.profile
|
|
# become: true
|
|
# ansible.builtin.copy:
|
|
# src: etc/skel/.profile
|
|
# dest: /etc/skel/.profile
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rw,go=
|
|
# backup: true
|
|
|
|
# - name: Make sure /etc/skel/.bashrc.d exists
|
|
# become: true
|
|
# ansible.builtin.file:
|
|
# path: /etc/skel/.bashrc.d
|
|
# state: directory
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rwx,go=
|
|
|
|
# - name: Get /etc/skel/.bashrc
|
|
# become: true
|
|
# ansible.builtin.copy:
|
|
# src: etc/skel/.bashrc
|
|
# dest: /etc/skel/.bashrc
|
|
# owner: root
|
|
# group: root
|
|
# mode: u=rw,go=
|
|
# backup: true
|
|
|
|
- name: Get /etc/skel
|
|
become: true
|
|
ansible.builtin.copy:
|
|
src: etc/skel
|
|
dest: /etc/
|
|
owner: root
|
|
group: root
|
|
directory_mode: u=rwx,go=rx
|
|
mode: u=rw,go=
|
|
backup: true
|
|
|
|
#### User: root
|
|
|
|
- name: Set root's authorized_keys
|
|
become: true
|
|
ansible.posix.authorized_key:
|
|
user: root
|
|
state: present
|
|
key: "{{ lookup('file', item) }}"
|
|
loop:
|
|
- files/ssh-keys/heath.pub
|
|
|
|
- name: Lock the root user's password
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: root
|
|
password_lock: true
|
|
|
|
|
|
#### User: first
|
|
|
|
- name: Create the first user
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: first
|
|
comment: First User
|
|
state: present
|
|
system: false
|
|
groups: hpf-sudo-np
|
|
append: true
|
|
create_home: true
|
|
shell: /usr/bin/bash
|
|
|
|
- name: Set first's authorized_keys
|
|
become: true
|
|
ansible.posix.authorized_key:
|
|
user: first
|
|
state: present
|
|
key: "{{ lookup('file', item) }}"
|
|
loop:
|
|
- files/ssh-keys/first.pub
|
|
- files/ssh-keys/heath.pub
|
|
|
|
|
|
#### User: hpf-ans
|
|
|
|
- name: Create the hpf-ans group
|
|
become: true
|
|
ansible.builtin.group:
|
|
name: hpf-ans
|
|
state: present
|
|
system: true
|
|
gid: 800
|
|
|
|
- name: Create the hpf-ans user
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: hpf-ans
|
|
state: present
|
|
system: true
|
|
uid: 800
|
|
group: hpf-ans
|
|
groups: hpf-sudo-np
|
|
append: true
|
|
create_home: true
|
|
shell: /usr/bin/bash
|
|
password_lock: true
|
|
|
|
- name: Get /home/hpf-ans/bin
|
|
become: true
|
|
become_user: hpf-ans
|
|
ansible.builtin.copy:
|
|
src: home/hpf-ans/bin
|
|
dest: $HOME/
|
|
owner: hpf-ans
|
|
group: hpf-ans
|
|
directory_mode: u=rwx,go=
|
|
mode: u=rwx,go=
|
|
backup: true
|
|
|
|
- name: Set hpf-ans's authorized_keys
|
|
become: true
|
|
ansible.posix.authorized_key:
|
|
user: hpf-ans
|
|
state: present
|
|
key: "{{ lookup('file', item) }}"
|
|
loop:
|
|
- files/ssh-keys/heath.pub
|
|
|
|
- name: Make sure pip is up to date
|
|
become: true
|
|
become_user: hpf-ans
|
|
ansible.builtin.pip:
|
|
name: pip
|
|
virtualenv: $HOME/.ansible-venv
|
|
extra_args: --upgrade
|
|
|
|
- name: Make sure ansible is up to date
|
|
become: true
|
|
become_user: hpf-ans
|
|
ansible.builtin.pip:
|
|
name: ansible
|
|
virtualenv: $HOME/.ansible-venv
|
|
extra_args: --upgrade
|
|
|
|
|
|
#### User: heath
|
|
|
|
- name: Create the heath group
|
|
become: true
|
|
ansible.builtin.group:
|
|
name: heath
|
|
state: present
|
|
system: false
|
|
gid: 60001
|
|
|
|
- name: Create the heath user
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: heath
|
|
comment: Heath Petersen
|
|
state: present
|
|
system: false
|
|
uid: 60001
|
|
group: heath
|
|
groups: hpf-sudo
|
|
append: true
|
|
create_home: true
|
|
shell: /usr/bin/bash
|
|
password: '$y$j9T$.NJVASBkVLnvqgznpcpdx1$7poH23pou7VHti3IfvDzwECdLtTcMercYNCeevgV.xC'
|
|
|
|
- name: Set heath's authorized_keys
|
|
become: true
|
|
ansible.posix.authorized_key:
|
|
user: heath
|
|
state: present
|
|
key: "{{ lookup('file', item) }}"
|
|
loop:
|
|
- files/ssh-keys/heath.pub
|
|
|
|
|
|
#### ansible-pull.sh
|
|
|
|
# - name: Make sure /home/hpf-ans/bin exists
|
|
# become: true
|
|
# become_user: hpf-ans
|
|
# ansible.builtin.file:
|
|
# path: $HOME/bin
|
|
# state: directory
|
|
# owner: hpf-ans
|
|
# group: hpf-ans
|
|
# mode: u=rwx,go=
|
|
|
|
# - name: Get /home/hpf-ans/bin/ansible-pull.sh
|
|
# become: true
|
|
# become_user: hpf-ans
|
|
# ansible.builtin.copy:
|
|
# src: home/hpf-ans/bin/ansible-pull.sh
|
|
# dest: $HOME/bin/ansible-pull.sh
|
|
# owner: hpf-ans
|
|
# group: hpf-ans
|
|
# mode: u=rwx,go=
|
|
# backup: true
|
|
|
|
- name: Make sure log directory exists
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: /var/log/ansible-pull.sh
|
|
state: directory
|
|
owner: hpf-ans
|
|
group: root
|
|
mode: u=rwx,g=r,o=
|
|
|
|
# - name: Create ansible-pull.sh crontab entry
|
|
# become: true
|
|
# become_user: hpf-ans
|
|
# ansible.builtin.cron:
|
|
# name: "ansible-pull"
|
|
# minute: "*/27"
|
|
# job: $HOME/bin/ansible-pull.sh
|
|
# backup: true
|
|
|
|
- name: Rotate ansible-pull.sh.log
|
|
become: true
|
|
community.general.logrotate:
|
|
name: ansible-pull.sh
|
|
paths:
|
|
- /var/log/ansible-pull.sh/*.log
|
|
rotation_period: daily
|
|
rotate_count: 32
|
|
compress: true
|
|
compress_options: "-9"
|
|
delay_compress: true
|
|
missing_ok: true
|
|
not_if_empty: true
|
|
backup: true
|
|
|
|
|
|
#### Clean System Software
|
|
|
|
- name: Remove packages installed as dependencies that are no longer required and purge their configuration files
|
|
become: true
|
|
ansible.builtin.apt:
|
|
autoremove: true
|
|
purge: true
|
|
|
|
- name: Remove old downloaded packages
|
|
become: true
|
|
ansible.builtin.apt:
|
|
autoclean: true
|
|
|
|
|
|
#### Handlers
|
|
|
|
handlers:
|
|
|
|
- name: Restart sshd
|
|
become: true
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: restarted
|