Added password prompt and declared ansible_user variable

.ansible/roles/lockdown/tasks/git.yml

@@ -88,7 +88,7 @@
     block:
       - name: Transfer private SSH keys
         ansible.builtin.copy:
-          src: ssh/{{ item }}.ppk
+          src: ssh/{{ ansible_facts['user_id'] }}/{{ item }}.ppk
           dest: "{{ ansible_facts['user_dir'] }}/.ssh/{{ item }}.ppk"
           force: yes
           backup: yes
@@ -100,7 +100,7 @@
         register: created_ssh_private_keys
       - name: Transfer public SSH keys
         ansible.builtin.copy:
-          src: ssh/{{ item }}.pub
+          src: ssh/{{ ansible_facts['user_id'] }}/{{ item }}.pub
           dest: "{{ ansible_facts['user_dir'] }}/.ssh/{{ item }}.pub"
           force: yes
           backup: yes

.ansible/roles/lockdown/tasks/gpg.yml

@@ -27,7 +27,7 @@
 - name: Acquire GPG private keys
   when: files_mode
   ansible.builtin.copy:
-    src: gnupg/{{ item }}.asc
+    src: gnupg/{{ ansible_facts['user_id'] }}/{{ item }}.asc
     dest: "{{ ansible_facts['user_dir'] }}/.gnupg/{{ item }}.priv.asc"
     force: yes
     backup: yes

.ansible/roles/lockdown/tasks/main.yml

@@ -47,6 +47,7 @@
   when: not files_mode and ansible_facts["user_id"] == "root"
   block:
     - name: Acquire list of SSH public keys for sys-admin user
+      delegate_to: "{{ ssh_keypairs_origin_host }}"
       ansible.builtin.find:
         paths: "{{ lookup('env', 'HOME') }}/.ssh"
         patterns:
@@ -58,10 +59,18 @@
         - administrative_user
         - admin_ssh
       register: ssh_public_keys
+    - name: Acquire contents of SSH public keys for sys-admin user
+      delegate_to: "{{ ssh_keypairs_origin_host }}"
+      ansible.builtin.command:
+        argv:
+          - cat
+          - "{{ item.path }}"
+      loop: "{{ ssh_public_keys.files }}"
+      register: ssh_public_keys_contents
     - name: Register SSH public keys as sys-admin user's authorized keys
       ansible.builtin.lineinfile:
         path: "{{ created_admin.home }}/.ssh/authorized_keys"
-        line: "{{ lookup('ansible.builtin.file', item.path) }}"
+        line: "{{ item }}"
         owner: "{{ created_admin.name }}"
         group: "{{ created_admin.name }}"
         mode: "0600"
@@ -72,8 +81,8 @@
         - default
         - administrative_user
         - admin_ssh
-      loop: "{{ ssh_public_keys.files }}"
+      loop: "{{ ssh_public_keys_contents.results }}"
-    - name: Register SSH puplic keys as other users' authorized keys
+    - name: Register SSH public keys as other users' authorized keys
       ansible.builtin.copy:
         src: "ssh/{{ item.name }}/authorized_keys"
         dest: "{{ item.home }}/.ssh/authorized_keys"

.gitignore

@@ -6,23 +6,58 @@ senpai/
 /galaxy_token
 .ansible/log.txt
 .ansible/facts/
-.ansible/roles/**/vars/*
-.ansible/roles/**/files/ssh/*
-.ansible/roles/**/*/files/sshd_config.d/*.conf
-.ansible/roles/**/*/templates/sshd_config.d/*.conf
 .ansible/collections/ansible_collections/
-/playbooks/group_vars/**/main.yml
+*.bak
-/playbooks/host_vars/**/main.yml
+
-/playbooks/**/ssh_keys_vault.yml
+group_vars/**/main.yml
-/playbooks/**/ssh_keys.yml
+host_vars/**/main.yml
-/playbooks/files/**/bash/bash_aliases
+**/group_vars/**/main.yml
-/playbooks/files/**/bash/**/bash_aliases
+**/host_vars/**/main.yml
-/playbooks/files/**/bash/bash_functions
+group_vars/**/vault.yml
-/playbooks/files/**/bash/**/bash_functions
+host_vars/**/vault.yml
-/playbooks/files/**/ssh/config
+**/group_vars/**/vault.yml
-/playbooks/files/**/ssh/**/config
+**/host_vars/**/vault.yml
-/playbooks/files/**/xdg/user-dirs.defaults
+
-/playbooks/files/**/xdg/**/user-dirs.defaults
+.ansible/roles/**/vars/*
+playbooks/vars/ssh_keys_vault.yml
+playbooks/vars/ssh_keys.yml
+**/playbooks/vars/ssh_keys_vault.yml
+**/playbooks/vars/ssh_keys.yml
+playbooks/vars/main.yml
+playbooks/vars/vault.yml
+**/playbooks/vars/main.yml
+**/playbooks/vars/vault.yml
+
+files/**/**/config
+**/files/**/**/config
+files/**/**/authorized_keys
+**/files/**/**/authorized_keys
+files/**/**/*.conf
+**/files/**/**/*.conf
+files/**/**/*.dirs
+**/files/**/**/*.dirs
+files/**/**/*.defaults
+**/files/**/**/*.defaults
+files/**/**/bash_aliases
+**/files/**/**/bash_aliases
+files/**/**/bash_functions
+**/files/**/**/bash_functions
+
+templates/**/**/config
+**/templates/**/**/config
+templates/**/**/authorized_keys
+**/templates/**/**/authorized_keys
+templates/**/**/*.conf
+**/templates/**/**/*.conf
+templates/**/**/*.dirs
+**/templates/**/**/*.dirs
+templates/**/**/*.defaults
+**/templates/**/**/*.defaults
+templates/**/**/bash_aliases
+**/templates/**/**/bash_aliases
+templates/**/**/bash_functions
+**/templates/**/**/bash_functions
+
 hosts.ini
 hosts.yml
 hosts.yaml

playbooks/files/servers/ssh/config.example

@@ -1,30 +0,0 @@
-Host local
-    HostName localhost
-    Port 22
-    # IdentitiesOnly yes
-    # IdentityFile ~/.ssh/*.ppk
-    # AddKeysToAgent yes
-
-Host local.me
-    HostName localhost
-    Port 22
-    # User admin
-    # IdentitiesOnly yes
-    # IdentityFile ~/.ssh/*.ppk
-    # AddKeysToAgent yes
-
-Host *.local.local
-    HostName localhost
-    # IdentitiesOnly yes
-    # IdentityFile ~/.ssh/*.ppk
-    # AddKeysToAgent yes
-
-Host ip4.local.local
-    # HostName 127.0.0.1
-    Port 22
-    AddressFamily inet
-
-Host ip6.local.local
-    # HostName ::1
-    Port 22
-    AddressFamily inet6

playbooks/files/servers/xdg/user-dirs.dirs.example

@@ -1,15 +0,0 @@
-# This file is written by xdg-user-dirs-update
-# If you want to change or add directories, just edit the line you're
-# interested in. All local changes will be retained on the next run.
-# Format is XDG_xxx_DIR="$HOME/yyy", where yyy is a shell-escaped
-# homedir-relative path, or XDG_xxx_DIR="/yyy", where /yyy is an
-# absolute path. No other format is supported.
-# 
-XDG_DESKTOP_DIR="$HOME/Desktop"
-XDG_DOWNLOAD_DIR="$HOME/Downloads"
-XDG_TEMPLATES_DIR="$HOME/Templates"
-XDG_PUBLICSHARE_DIR="$HOME/Public"
-XDG_DOCUMENTS_DIR="$HOME/Documents"
-XDG_MUSIC_DIR="$HOME/Music"
-XDG_PICTURES_DIR="$HOME/Pictures"
-XDG_VIDEOS_DIR="$HOME/Videos"

playbooks/init_login.yml

@@ -7,14 +7,11 @@
     - vars/ssh_keys.yml
   vars:
     ansible_user: "{{ passwords[0].username }}"
-    ansible_ssh_user: "{{ passwords[0].username }}"
     # @NOTE one of below two lines should be commented/uncommented in a mutually exclusive fashion
     # ansible_ssh_private_key_file: "{{ chosen_native_ssh_private_key_file | default(chosen_local_ssh_private_key_file, true) }}" # @NOTE only works with soft-coded SSH key list building
-    ansible_ssh_private_key_file: "{{ chosen_local_ssh_private_key_file }}"
+    ansible_ssh_private_key_file: "{{ chosen_local_ssh_private_key_file }}" # @NOTE references an inventory / group variable
     # @NOTE below three lines should only be uncommented when above two are commented and vice versa; key-based authentication should have already been enabled prior to running this playbook
     # ansible_password: "{{ passwords[0].password }}"
-    # ansible_ssh_pass: "{{ passwords[0].username }}"
-    # ansible_ssh_password: "{{ passwords[0].username }}"
     ansible_python_interpreter: “{{ ansible_playbook_python }}”
     personal_computers: locals # @NOTE can change to *_households group or {{ name }}_{{ surname }} group name
   vars_prompt:
@@ -43,7 +40,7 @@
     - name: Create global bash aliases
       become: yes
       ansible.builtin.copy:
-        src: files/all/bash/bash_aliases
+        src: bash/bash_aliases
         dest: /etc/bash_aliases
         owner: root
         group: root
@@ -58,7 +55,7 @@
     - name: Create global bash functions
       become: yes
       ansible.builtin.copy:
-        src: files/all/bash/bash_functions
+        src: bash/bash_functions
         dest: /etc/bash_functions
         owner: root
         group: root
@@ -110,7 +107,7 @@
             state: present
         - name: Create XDG user home directory environment variables
           ansible.builtin.copy:
-            src: "files/servers/{{ ansible_facts['user_id'] }}/xdg/user-dirs.dirs"
+            src: "xdg/{{ ansible_facts['user_id'] }}/user-dirs.dirs"
             dest: "{{ ansible_facts['user_dir'] }}/.config/user-dirs.dirs"
             owner: root
             group: root
@@ -140,7 +137,7 @@
             state: present
         - name: Create XDG user home directory environment variables
           ansible.builtin.copy:
-            src: "files/locals/{{ ansible_facts['user_id'] }}/xdg/user-dirs.dirs"
+            src: "xdg/{{ ansible_facts['user_id'] }}/user-dirs.dirs"
             dest: "{{ ansible_facts['user_dir'] }}/.config/user-dirs.dirs"
             owner: root
             group: root
@@ -159,7 +156,7 @@
       block:
         - name: Create user SSH configuration
           ansible.builtin.copy:
-            src: "files/locals/ssh/{{ ansible_facts['user_id'] }}/config"
+            src: "ssh/{{ ansible_facts['user_id'] }}/config"
             dest: "{{ ansible_facts['user_dir'] }}/.ssh/config"
             follow: yes
             force: yes

playbooks/manage_root.yml

@@ -2,8 +2,18 @@
 - name: manage_root
   hosts: servers # @NOTE for IPv6, switch to 'servers6' instead of 'servers4'--for both, 'servers'
   remote_user: root # MUST be run as root
-  # roles:
+  vars:
-  #   - lockdown
+    ansible_user: root
+    # ansible_ssh_user: root
+  vars_prompt:
+    - name: ansible_password
+      prompt: Enter pasword for root user of VPS
+      unsafe: yes
+      private: yes
+    # - name: ansible_ssh_pass
+    #   prompt: Enter pasword for root user of VPS
+    #   unsafe: yes
+    #   private: yes
   tasks:
     - name: Set up sys-admin account on VPS and secure VPS
       ansible.builtin.include_role:

playbooks/servers.yml

@@ -1,5 +1,5 @@
 ---
 - name: Lock down VPS
   ansible.builtin.import_playbook: manage_root.yml
-- name: Disable shell for root
+- name: Bootstrap VPS
   ansible.builtin.import_playbook: init_login.yml