REFACTOR: move removing unnecessary packages into base_system role

roles/basic_postinstall_/tasks/create_new_user.yaml

@@ -0,0 +1,66 @@
+---
+- name: Create a new user with a password, set shell
+  remote_user: ansible
+  ansible.builtin.user:
+    name: max
+    groups: sshusers,sudo
+    password: "{{ user_passwd_hash }}"
+    shell: /bin/zsh
+
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: present
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
+
+- name: Copy omz installation wrapper script to the target machine
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/install_omz.sh"
+    dest: /home/max/install_omz.sh
+    owner: max
+    group: max
+    mode: u=rwx,g=r,o-rwx
+
+# WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
+- name: Install oh my zsh
+  remote_user: max
+  become: false
+  ansible.builtin.command: /home/max/install_omz.sh
+  changed_when: true
+
+- name: Configure oh my zsh, by pushing the config file
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.zshrc"
+    dest: /home/max/.zshrc
+    owner: max
+    group: max
+    mode: u=rw,g=r,o-rwx
+
+- name: Configure vim, by pushing the config
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.vimrc"
+    dest: /home/max/.vimrc
+    owner: max
+    group: max
+    mode: u=rw,g=r,o-rwx
+
+
+# WARNING: we've finished with the initial setup, drop ansible key
+# Push regular user key
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: absent
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
+
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: present
+    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"

roles/basic_postinstall_/tasks/harden_ssh.yaml

@@ -0,0 +1,36 @@
+---
+
+- name: Configure ssh-server daemon
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/hardened_sshd.conf"
+    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
+    mode: u=rw,g=r,o=r
+  when: ansible_facts['distribution'] == 'Ubuntu'
+
+- name: Configure ssh-server daemon
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/hardened_sshd.conf"
+    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
+    mode: u=rw,g=r,o=r
+  when: ansible_facts['distribution'] == 'Debian'
+
+- name: Configure ssh client
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/hardened_ssh.conf"
+    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
+    mode: u=rw,g=r,o=r
+
+- name: Restart ssh-server Debian
+  remote_user: ansible
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
+  when: ansible_facts['distribution'] == 'Debian'
+
+- name: Restart ssh-server Ubuntu
+  remote_user: ansible
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+  when: ansible_facts['distribution'] == 'Ubuntu'

roles/basic_postinstall_/tasks/install_basic_utils.yaml

@@ -0,0 +1,42 @@
+---
+- name: Installing basic utils for comfort work (apt-based system)
+  when: (ansible_facts['distribution'] == "Debian") or
+        (ansible_facts['distribution'] == "Ubuntu")
+  ansible.builtin.apt:
+    name:
+      - vim
+      - ranger
+      - zsh
+      - rsync
+      - git
+      - curl
+      - kitty
+      - unattended-upgrades
+      - ssh
+      - openssh-server
+    update-cache: true # Run apt update before installation
+  become: true
+  remote_user: ansible
+
+- name: Install qemu-guest-agent on VM
+  when:
+    - ansible_facts['os_family'] == "Debian"
+    - ansible_facts['virtualization_type'] == "kvm"
+  ansible.builtin.apt:
+    name: qemu-guest-agent
+    state: present
+    update-cache: true # Run apt update before installation
+  become: true
+  remote_user: ansible
+  tags:
+    - kvm-guests
+    - packages
+
+
+# The same commands for Alpine
+- name: Update and install packages on Alpine
+  when: (ansible_facts['distribution'] == "Alpine")
+  community.general.apk:
+    name: vim ranger zsh rsync git curl kitty openssh
+    update_cache: true
+  remote_user: ansible

roles/basic_postinstall_/tasks/main.yaml

@@ -0,0 +1,18 @@
+---
+- name: Create and set up Ansible user and environment
+  ansible.builtin.include_tasks: prepare_ansible_user.yaml
+
+- name: Improve SSH configuration
+  ansible.builtin.include_tasks: harden_ssh.yaml
+
+- name: Install basic utils
+  ansible.builtin.include_tasks: install_basic_utils.yaml
+
+- name: Remove unnecessary packages
+  ansible.builtin.include_tasks: remove_packages.yaml
+
+- name: Create and set up a new user
+  ansible.builtin.include_tasks: create_new_user.yaml
+
+- name: Set locale and time
+  ansible.builtin.include_tasks: set_locale_and_time.yaml

roles/basic_postinstall_/tasks/prepare_ansible_user.yaml

@@ -0,0 +1,41 @@
+---
+## Installing packages
+- name: Install sudo on apt systems
+  when: (ansible_facts['distribution'] == "Debian") or
+        (ansible_facts['distribution'] == "Ubuntu")
+  ansible.builtin.apt:
+    name:
+      - sudo
+    update-cache: true
+
+# The same commands for Alpine
+- name: Update and install packages on Alpine
+  when: (ansible_facts['distribution'] == "Alpine")
+  community.general.apk:
+    name: sudo
+    update_cache: true
+  remote_user: ansible
+
+
+## Creating and setting up the ansible user
+## First, create sshusers group to grant ssh access
+- name: Ensure group "sshusers" exists
+  ansible.builtin.group:
+    name: sshusers
+    state: present
+
+## Add the user to sshusers (for ssh access) and sudo (gain root access)
+- name: Create a new user with a password for Ansible
+  ansible.builtin.user:
+    name: ansible
+    password: "{{ ansible_user_passwd_hash }}"
+
+    groups: sshusers,sudo
+    append: true
+
+## Since password authentication in SSH will be disabled, we need to add an authorized key
+- name: Set authorized key taken from file
+  ansible.posix.authorized_key:
+    user: ansible
+    state: present
+    key: "{{ ansible_ssh_key }}"

roles/basic_postinstall_/tasks/remove_packages.yaml

@@ -0,0 +1,31 @@
+---
+# Remove multiple packages at once
+- name: Remove unnecessary packages
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Debian") or
+        (ansible_facts['distribution'] == "Ubuntu")
+  ansible.builtin.apt:
+    name:
+      - nano
+    state: absent
+  become: true
+
+
+# Clean up all orphaned packages
+- name: Remove all orphaned dependencies
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Debian") or
+        (ansible_facts['distribution'] == "Ubuntu")
+  ansible.builtin.apt:
+    autoremove: true
+    purge: true
+
+
+- name: Install sudo package on Alpine
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Alpine")
+  community.general.apk:
+    name:
+      - nano
+    state: absent
+  become: true

roles/basic_postinstall_/tasks/set_locale_and_time.yaml

@@ -0,0 +1,19 @@
+---
+- name: Generate locales
+  community.general.locale_gen:
+    name:
+      - en_US.UTF-8
+      - ru_RU.UTF-8
+    state: present
+
+- name: Set locale
+  ansible.builtin.copy:
+    dest: /etc/locale.conf
+    mode: '0644'
+    content: |
+      LANG=en_US.UTF-8
+      LC_ALL=en_US.UTF-8
+
+- name: Set time
+  community.general.timezone:
+    name: Europe/Samara