8c1a6e13e4
es una version jibarizada, que solo incluye los roles principales: - althost que orquesta todo - proxy reverso Nginx dockerizado - certbot maneja SSL de este - dns es un servidor DNS bind9 - rap es la VPN - users gestiona usuarixs linux
61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
- block:
|
|
- name: ensure sudo is present
|
|
tags: apt
|
|
apt: name=sudo state=present
|
|
|
|
- name: Make sure we have a 'sudo' group
|
|
group: name=sudo state=present
|
|
|
|
- name: Allow 'sudo' group to have passwordless sudo
|
|
lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
regexp: '^%sudo'
|
|
line: '%sudo ALL=(ALL) NOPASSWD: ALL'
|
|
|
|
- name: Ensure user is present
|
|
user:
|
|
name: "{{ item.0.name }}"
|
|
comment: "{{ item.0.comment }}"
|
|
state: present
|
|
shell: "{{ item.0.shell | default('/bin/bash') }}"
|
|
with_subelements:
|
|
- "{{ ssh_users }}"
|
|
- servers_allow
|
|
- skip_missing: true
|
|
when: (item.1 == inventory_hostname or item.1 == "all") and (item.0.root is undefined)
|
|
|
|
- name: Ensure user is in sudo group
|
|
user:
|
|
name: "{{ item.0.name }}"
|
|
state: present
|
|
groups: sudo
|
|
append: yes
|
|
with_subelements:
|
|
- "{{ ssh_users }}"
|
|
- servers_allow
|
|
- skip_missing: true
|
|
when: ( item.1 == inventory_hostname or item.1 == "all" ) and (item.0.sudo is defined and item.0.sudo)
|
|
|
|
- name: Populate user authorized_keys
|
|
authorized_key: user="{{ item.0.name }}"
|
|
key="{{ lookup('file', 'ssh/'+item.0.name+'.pub') }}"
|
|
state=present
|
|
with_subelements:
|
|
- "{{ ssh_users }}"
|
|
- servers_allow
|
|
- skip_missing: true
|
|
when: (item.1 == inventory_hostname or item.1 == "all") and (item.0.root is undefined)
|
|
|
|
- name: Populate root's authorized_keys
|
|
authorized_key: user="root"
|
|
key="{{ lookup('file', 'ssh/'+item.0.name+'.pub') }}"
|
|
state=present
|
|
with_subelements:
|
|
- "{{ ssh_users }}"
|
|
- servers_allow
|
|
- skip_missing: true
|
|
when: (item.1 == inventory_hostname or item.1 == "all") and (item.0.root is defined and item.0.root)
|
|
|
|
tags: users
|