FIX: roles naming style changed

2026-07-07 17:45:47 +00:00
parent e906b214ea
commit ad30e36486
17 changed files with 3 additions and 3 deletions
@@ -0,0 +1,65 @@
+---
+- name: Create a new user with a password, set shell
+  remote_user: ansible
+  user: 
+    name: max
+    groups: sshusers,sudo
+    password: "{{ user_passwd_hash }}"
+    shell: /bin/zsh
+
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: present
+    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}"
+
+- name: Copy omz installation wrapper script to the target machine
+  remote_user: ansible
+  copy:
+    src: ../files/install_omz.sh
+    dest: /home/max/install_omz.sh
+    owner: max
+    group: max
+    mode: u=rwx,g=r,o-rwx
+
+# WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
+- name: Install oh my zsh
+  remote_user: max
+  become: no
+  command: /home/max/install_omz.sh 
+
+- name: Configure oh my zsh, by pushing the config file
+  remote_user: ansible
+  copy:
+    src: ../files/.zshrc
+    dest: /home/max/.zshrc
+    owner: max
+    group: max
+    mode: u=rw,g=r,o-rwx
+
+- name: Configure vim, by pushing the config
+  remote_user: ansible
+  copy:
+    src: ../files/.vimrc
+    dest: /home/max/.vimrc
+    owner: max
+    group: max
+    mode: u=rw,g=r,o-rwx
+
+
+# WARNING: we've finished with the initial setup, drop ansible key
+# Push regular user key
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: absent
+    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/ansible_key.pub') }}"
+
+- name: Set authorized key taken from file
+  remote_user: ansible
+  ansible.posix.authorized_key:
+    user: max
+    state: present
+    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/max_regular_key.pub') }}"
@@ -0,0 +1,16 @@
+---
+
+- name: Configure ssh-server daemon
+  copy:
+    src: ../files/hardened_sshd.conf
+    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
+    mode: u=rw,g=r,o=r
+  notify: restart sshd
+
+
+- name: Configure ssh client
+  remote_user: ansible
+  copy:
+    src: ../files/hardened_ssh.conf
+    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
+    mode: u=rw,g=r,o=r
@@ -0,0 +1,29 @@
+---
+- name: Installing basic utils for comfort work (apt-based system)
+  when: (ansible_facts['distribution'] == "Debian") or 
+        (ansible_facts['distribution'] == "Ubuntu")
+  apt:
+    name:
+      - vim
+      - ranger
+      - zsh
+      - rsync
+      - git
+      - curl
+      - kitty
+      - unattended-upgrades
+    update-cache: yes # Run apt update before installation
+  become: yes
+  remote_user: ansible
+
+
+# The same commands for Alpine
+- name: Update Alpine packages
+  when: (ansible_facts['distribution'] == "Alpine")
+  command: /sbin/apk update
+  remote_user: ansible
+
+- name: Install the packages on Alpine
+  when: (ansible_facts['distribution'] == "Alpine")
+  command: /sbin/apk add vim ranger zsh rsync git curl kitty
+  remote_user: ansible
@@ -0,0 +1,18 @@
+---
+- name: Create and set up Ansible user and environment
+  ansible.builtin.include_tasks: prepare_ansible_user.yaml
+
+- name: Improve SSH configuration
+  ansible.builtin.include_tasks: harden_ssh.yaml
+
+- name: Install basic utils
+  ansible.builtin.include_tasks: install_basic_utils.yaml
+
+- name: Remove unnecessary packages
+  ansible.builtin.include_tasks: remove_packages.yaml
+
+- name: Create and set up a new user
+  ansible.builtin.include_tasks: create_new_user.yaml
+
+- name: Set locale and time
+  ansible.builtin.include_tasks: set_locale_and_time.yaml
@@ -0,0 +1,41 @@
+---
+## Installing packages
+- name: Install sudo on apt systems
+  when: (ansible_facts['distribution'] == "Debian") or 
+        (ansible_facts['distribution'] == "Ubuntu")
+  apt:
+    name:
+      - sudo
+    update-cache: yes
+
+- name: Update Alpine packages
+  when: (ansible_facts['distribution'] == "Alpine")
+  command: /sbin/apk update
+
+- name: Install sudo package on Alpine
+  when: (ansible_facts['distribution'] == "Alpine")
+  command: /sbin/apk add sudo
+
+
+## Creating and setting up the ansible user
+## First, create sshusers group to grant ssh access
+- name: Ensure group "sshusers" exists
+  ansible.builtin.group:
+    name: sshusers
+    state: present
+
+## Add the user to sshusers (for ssh access) and sudo (gain root access)
+- name: Create a new user with a password for Ansible
+  user: 
+    name: ansible
+    password: "{{ ansible_user_passwd_hash }}"
+
+    groups: sshusers,sudo
+    append: yes
+
+## Since password authentication in SSH will be disabled, we need to add an authorized key 
+- name: Set authorized key taken from file
+  ansible.posix.authorized_key:
+    user: ansible
+    state: present
+    key: "{{ ansible_ssh_key }}"
@@ -0,0 +1,27 @@
+---
+# Remove multiple packages at once
+- name: Remove unnecessary packages
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Debian") or 
+        (ansible_facts['distribution'] == "Ubuntu")
+  apt:
+    name:
+      - nano
+    state: absent
+  become: yes
+
+
+# Clean up all orphaned packages
+- name: Remove all orphaned dependencies
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Debian") or 
+        (ansible_facts['distribution'] == "Ubuntu")
+  apt:
+    autoremove: yes
+    purge: yes
+
+
+- name: Install sudo package on Alpine
+  remote_user: ansible
+  when: (ansible_facts['distribution'] == "Alpine")
+  command: /sbin/apk del nano
@@ -0,0 +1,19 @@
+---
+- name: Generate locales
+  ansible.builtin.locale_gen:
+    name:
+        - en_US.UTF-8
+        - ru_RU.UTF-8
+    state: present
+
+- name: Set locale
+  ansible.builtin.copy:
+    dest: /etc/locale.conf
+    mode: '0644'
+    content: |
+      LANG=en_US.UTF-8
+      LC_ALL=en_US.UTF-8
+
+- name: Set time
+  ansible.builtin.timezone:
+    name: Europe/Samara