Harwinder Sekhon
7ff69de8c4
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEczyvRjfakkiDNkbZA7PR
105 lines
3.7 KiB
YAML
105 lines
3.7 KiB
YAML
---
|
|
# Creates a non-root admin user with sudo and the homelab SSH keys on every
|
|
# reachable Ubuntu/Rocky guest. First step toward running Ansible as a
|
|
# non-root user.
|
|
#
|
|
# Extra vars (optional):
|
|
# admin_user - default harry
|
|
# admin_sudo_nopasswd - default true (required for unattended become)
|
|
# admin_ssh_keys - list of public keys (defaults to the ansible-key and
|
|
# the personal key already used by add_root_key.yml)
|
|
|
|
- name: Check Host Availability
|
|
hosts: ubuntu:rocky
|
|
gather_facts: false
|
|
ignore_unreachable: true
|
|
|
|
tasks:
|
|
- name: Ping hosts to check availability
|
|
ansible.builtin.ping:
|
|
register: ping_result
|
|
ignore_errors: true
|
|
ignore_unreachable: true
|
|
|
|
- name: Add reachable hosts to group
|
|
ansible.builtin.group_by:
|
|
key: reachable_hosts
|
|
when: ping_result is succeeded
|
|
|
|
- name: Report offline hosts
|
|
ansible.builtin.debug:
|
|
msg: "{{ inventory_hostname }} - OFFLINE"
|
|
when: ping_result is not succeeded
|
|
delegate_to: localhost
|
|
|
|
- name: User Setup - Create admin user on Ubuntu
|
|
hosts: ubuntu:&reachable_hosts
|
|
become: true
|
|
gather_facts: false
|
|
|
|
vars:
|
|
admin_user: harry
|
|
|
|
tasks:
|
|
- name: Create admin user in the sudo group - {{ admin_user }}
|
|
ansible.builtin.user:
|
|
name: "{{ admin_user }}"
|
|
shell: /bin/bash
|
|
groups: sudo
|
|
append: true
|
|
create_home: true
|
|
|
|
- name: User Setup - Create admin user on Rocky Linux
|
|
hosts: rocky:&reachable_hosts
|
|
become: true
|
|
gather_facts: false
|
|
|
|
vars:
|
|
admin_user: harry
|
|
|
|
tasks:
|
|
- name: Create admin user in the wheel group - {{ admin_user }}
|
|
ansible.builtin.user:
|
|
name: "{{ admin_user }}"
|
|
shell: /bin/bash
|
|
groups: wheel
|
|
append: true
|
|
create_home: true
|
|
|
|
- name: User Setup - Authorized keys and sudo
|
|
hosts: reachable_hosts
|
|
become: true
|
|
gather_facts: false
|
|
|
|
vars:
|
|
admin_user: harry
|
|
admin_sudo_nopasswd: true
|
|
admin_ssh_keys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key"
|
|
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbFKxd6W+gHcNrugkxMwvixGmk3LxtsMEnSdaFp4L78WZ4VhdZrsnSJQ/rViT+vuc6K5SeugtggfQ90L25UyyMv2BhLZaoMS2dpoVJEZon/Y2Hemm11vdEApAK/u0kPTTM5JB0/TZfpoP9sr4pmRIUruRXBhLDvtUV9tJvKSzbhChtB+vBg+MpywG9VvDP6eCVpFaP43RcAFtJR7irJmexd5m4CVhIFaWNeTbbe8YI08i2gDinYl95ygu9i/TorQKLWme2v9ejxQFfJTWGaXHnQ18W0X94Ns4a4OccGcvJ8JmvYsaAPRAOSveq1Fpdw1VXHSKigTmRl6pHWd9/rq6K6Ojctbjo1kHiNHdLKLZbLDeM0OQlzNl74snsImmZddY59wnOKyHtfY0ZI7sQ+7A/0cSaMY6h7lt2xK0WmayuoT8UtKZlItZHCkOA5bV29arI/HTz+yR/LW8SihPPFpVv5aDiOUs0PYd9j0+CtULBJeYpMQJpkD93g06vgEJjhUOBZ6JmilxVDihDARU0x0xiRCQJcq4Nhk/x3GzPe2kkrTI+nZFaQn1K8hcBdSyA12/xAG8Fh1SMCxLwJdCNuL3gQoYd6XPzKqn6BIqAgiyq5DbHhO6mehOye4Rro6i/H1UkZe862QH/R5uH+8Z2/FYRpiCPzQyLwrqx/eVfT7JMFQ== harwinder@harwinder.net" # yamllint disable-line rule:line-length
|
|
|
|
tasks:
|
|
- name: Add authorized keys for {{ admin_user }}
|
|
ansible.posix.authorized_key:
|
|
user: "{{ admin_user }}"
|
|
key: "{{ item }}"
|
|
state: present
|
|
loop: "{{ admin_ssh_keys }}"
|
|
loop_control:
|
|
label: "{{ item.split()[-1] }}"
|
|
|
|
- name: Grant sudo to {{ admin_user }}
|
|
ansible.builtin.copy:
|
|
dest: "/etc/sudoers.d/90-{{ admin_user }}"
|
|
content: "{{ admin_user }} ALL=(ALL) {{ 'NOPASSWD:' if admin_sudo_nopasswd | bool else '' }}ALL\n"
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Summary
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
{{ inventory_hostname }} - user {{ admin_user }} ready
|
|
(sudo {{ 'NOPASSWD' if admin_sudo_nopasswd | bool else 'with password' }}, {{ admin_ssh_keys | length }} key(s))
|