72 lines
2.5 KiB
YAML
72 lines
2.5 KiB
YAML
---
|
|
- name: init_login
|
|
hosts: servers # @NOTE for IPv6, switch to 'servers6' instead of 'servers4'--for both, 'servers'
|
|
vars_files:
|
|
# @NOTE if second line is uncommented with its variables actively in use, first line should too be uncommented
|
|
# - vars/ssh_keys_vault.yml
|
|
- vars/ssh_keys.yml
|
|
vars:
|
|
ansible_user: "{{ passwords[0].username }}"
|
|
ansible_ssh_user: "{{ passwords[0].username }}"
|
|
# @NOTE one of below two lines should be commented/uncommented in a mutually exclusive fashion
|
|
# ansible_ssh_private_key_file: "{{ chosen_native_ssh_private_key_file | default(chosen_local_ssh_private_key_file, true) }}" # @NOTE only works with soft-coded SSH key list building
|
|
ansible_ssh_private_key_file: "{{ chosen_local_ssh_private_key_file }}"
|
|
# @NOTE below three lines should only be uncommented when above two are commented and vice versa; key-based authentication should have already been enabled prior to running this playbook
|
|
# ansible_password: "{{ passwords[0].password }}"
|
|
# ansible_ssh_pass: "{{ passwords[0].username }}"
|
|
# ansible_ssh_password: "{{ passwords[0].username }}"
|
|
tasks:
|
|
- name: Disable shell access for root
|
|
ansible.builtin.include_role:
|
|
name: lockdown
|
|
defaults_from: main
|
|
vars_from: main
|
|
handlers_from: main
|
|
tasks_from: deshell
|
|
apply:
|
|
become: yes
|
|
- name: Create global bash aliases
|
|
become: yes
|
|
ansible.builtin.copy:
|
|
src: files/all/bash/bash_aliases
|
|
dest: "/etc/bash_aliases"
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
- name: Create global bash functions
|
|
become: yes
|
|
ansible.builtin.copy:
|
|
src: files/all/bash/bash_functions
|
|
dest: "/etc/bash_functions"
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
- name: Register bash aliases and functions to global bashrc
|
|
become: yes
|
|
ansible.builtin.blockinfile:
|
|
block: |
|
|
if [ -f /etc/bash_aliases ]; then
|
|
. /etc/bash_aliases
|
|
fi
|
|
|
|
if [ -f /etc/bash_functions ]; then
|
|
. /etc/bash_functions
|
|
fi
|
|
path: "/etc/bash.bashrc"
|
|
prepend_newline: yes
|
|
marker: "# {mark} ANSIBLE MANAGED SYSTEM-WIDE BASH ALIASES AND FUNCTIONS BLOCK"
|
|
insertafter: EOF
|
|
create: yes
|
|
owner: root
|
|
group: root
|
|
backup: yes
|
|
state: present
|
|
|