74 lines
2.2 KiB
YAML
74 lines
2.2 KiB
YAML
---
|
|
# Bootstrap a fresh host: create the admin user with sudo and SSH access.
|
|
# Run this before any other playbook, when only root access is available:
|
|
#
|
|
# ansible-playbook playbooks/bootstrap.yml -l somehost
|
|
#
|
|
# After this, run other playbooks normally.
|
|
|
|
- name: Bootstrap admin user
|
|
hosts: "{{ target | default('all') }}"
|
|
gather_facts: false
|
|
vars:
|
|
ansible_user: root
|
|
ansible_become: false
|
|
# bootstrap_user: jambon
|
|
# bootstrap_ssh_public_key: "ssh-ed25519 AAAA..."
|
|
tasks:
|
|
- name: Detect OS and install python3 + sudo
|
|
ansible.builtin.raw: |
|
|
if command -v pacman > /dev/null 2>&1; then
|
|
pacman -Sy --noconfirm python sudo
|
|
elif command -v apt-get > /dev/null 2>&1; then
|
|
apt-get update -qq && apt-get install -y python3 sudo
|
|
else
|
|
echo "Unsupported OS" && exit 1
|
|
fi
|
|
changed_when: true
|
|
|
|
- name: Gather facts
|
|
ansible.builtin.setup:
|
|
|
|
- name: Create admin user
|
|
ansible.builtin.user:
|
|
name: "{{ bootstrap_user }}"
|
|
groups: "{{ 'wheel' if ansible_facts['os_family'] == 'Archlinux' else 'sudo' }}"
|
|
append: true
|
|
shell: /bin/bash
|
|
create_home: true
|
|
state: present
|
|
|
|
- name: Allow sudo group to use sudo (Debian)
|
|
ansible.builtin.copy:
|
|
content: "%sudo ALL=(ALL:ALL) ALL\n"
|
|
dest: /etc/sudoers.d/sudo
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
validate: visudo -cf %s
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Allow wheel group to use sudo (Arch)
|
|
ansible.builtin.copy:
|
|
content: "%wheel ALL=(ALL:ALL) ALL\n"
|
|
dest: /etc/sudoers.d/wheel
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
validate: visudo -cf %s
|
|
when: ansible_facts['os_family'] == 'Archlinux'
|
|
|
|
- name: Create .ssh directory
|
|
ansible.builtin.file:
|
|
path: "/home/{{ bootstrap_user }}/.ssh"
|
|
state: directory
|
|
owner: "{{ bootstrap_user }}"
|
|
group: "{{ bootstrap_user }}"
|
|
mode: "0700"
|
|
|
|
- name: Add SSH authorized key
|
|
ansible.posix.authorized_key:
|
|
user: "{{ bootstrap_user }}"
|
|
key: "{{ bootstrap_ssh_public_key | default(lookup('file', '~/.ssh/id_ed25519.pub')) }}"
|
|
state: present
|