330 lines
14 KiB
YAML
330 lines
14 KiB
YAML
---
|
|
- name: init_login
|
|
hosts: servers # @NOTE for IPv6, switch to 'servers6' instead of 'servers4'--for both, 'servers'
|
|
vars_files:
|
|
# @NOTE if second line is uncommented with its variables actively in use, first line should too be uncommented
|
|
# - vars/ssh_keys_vault.yml
|
|
- vars/ssh_keys.yml
|
|
vars:
|
|
ansible_user: "{{ passwords[0].username }}"
|
|
ansible_ssh_user: "{{ passwords[0].username }}"
|
|
# @NOTE one of below two lines should be commented/uncommented in a mutually exclusive fashion
|
|
# ansible_ssh_private_key_file: "{{ chosen_native_ssh_private_key_file | default(chosen_local_ssh_private_key_file, true) }}" # @NOTE only works with soft-coded SSH key list building
|
|
ansible_ssh_private_key_file: "{{ chosen_local_ssh_private_key_file }}"
|
|
# @NOTE below three lines should only be uncommented when above two are commented and vice versa; key-based authentication should have already been enabled prior to running this playbook
|
|
# ansible_password: "{{ passwords[0].password }}"
|
|
# ansible_ssh_pass: "{{ passwords[0].username }}"
|
|
# ansible_ssh_password: "{{ passwords[0].username }}"
|
|
ansible_python_interpreter: “{{ ansible_playbook_python }}”
|
|
personal_computers: locals # @NOTE can change to *_households group or {{ name }}_{{ surname }} group name
|
|
vars_prompt:
|
|
- name: gpg_import_passwords
|
|
prompt: Enter space-wrapped colon -separated list of GPG private key passwords
|
|
unsafe: yes
|
|
private: yes
|
|
- name: gpg_or_ssh_git_signing
|
|
prompt: Enter preferred signing key type (e.g., ssh or gpg)
|
|
unsafe: yes
|
|
private: no
|
|
default: "ssh"
|
|
- name: gpg_preferred_signing
|
|
prompt: Enter index or number of preferred signing key (negative number for random)
|
|
unsafe: yes
|
|
private: no
|
|
default: -1
|
|
- name: git_config_name
|
|
prompt: Enter name for your git configuration
|
|
unsafe: yes
|
|
private: no
|
|
- name: git_config_email
|
|
prompt: Enter email for your git configuration
|
|
unsafe: yes
|
|
private: no
|
|
tasks:
|
|
- name: Disable shell access for root
|
|
ansible.builtin.include_role:
|
|
name: lockdown
|
|
defaults_from: main
|
|
vars_from: main
|
|
handlers_from: main
|
|
tasks_from: deshell
|
|
apply:
|
|
become: yes
|
|
tags:
|
|
- default
|
|
- name: Create global bash aliases
|
|
become: yes
|
|
ansible.builtin.copy:
|
|
src: files/all/bash/bash_aliases
|
|
dest: /etc/bash_aliases
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
tags:
|
|
- default
|
|
- source_sys_bashrc
|
|
- name: Create global bash functions
|
|
become: yes
|
|
ansible.builtin.copy:
|
|
src: files/all/bash/bash_functions
|
|
dest: /etc/bash_functions
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
tags:
|
|
- default
|
|
- source_sys_bashrc
|
|
- name: Register bash aliases and functions to global bashrc
|
|
become: yes
|
|
ansible.builtin.blockinfile:
|
|
block: |
|
|
if [ -f /etc/bash_aliases ]; then
|
|
. /etc/bash_aliases
|
|
fi
|
|
|
|
if [ -f /etc/bash_functions ]; then
|
|
. /etc/bash_functions
|
|
fi
|
|
path: /etc/bash.bashrc
|
|
prepend_newline: yes
|
|
marker: "# {mark} ANSIBLE MANAGED SYSTEM-WIDE BASH ALIASES AND FUNCTIONS BLOCK"
|
|
insertafter: EOF
|
|
create: yes
|
|
owner: root
|
|
group: root
|
|
backup: yes
|
|
state: present
|
|
tags:
|
|
- default
|
|
- source_sys_bashrc
|
|
- name: Start XDG configuration tasks if in servers group
|
|
when: "'servers' in group_names and ansible_connection != 'local'"
|
|
become: yes
|
|
block:
|
|
- name: Create XDG user home directory environment variables
|
|
ansible.builtin.copy:
|
|
src: files/servers/xdg/user-dirs.defaults
|
|
dest: /etc/xdg/user-dirs.defaults
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
- name: Create XDG user home directory environment variables
|
|
ansible.builtin.copy:
|
|
src: "files/servers/{{ ansible_facts['user_id'] }}/xdg/user-dirs.dirs"
|
|
dest: "{{ ansible_facts['user_dir'] }}/.config/user-dirs.dirs"
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
tags:
|
|
- default
|
|
- create_xdg_config
|
|
- servers_exclusive
|
|
- name: Start XDG configuration tasks if current host in specified group
|
|
when: "personal_computers in group_names or ansible_connection == 'local'"
|
|
become: yes
|
|
block:
|
|
- name: Create XDG user home directory environment variables
|
|
ansible.builtin.copy:
|
|
src: files/locals/xdg/user-dirs.defaults
|
|
dest: /etc/xdg/user-dirs.defaults
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
- name: Create XDG user home directory environment variables
|
|
ansible.builtin.copy:
|
|
src: "files/locals/{{ ansible_facts['user_id'] }}/xdg/user-dirs.dirs"
|
|
dest: "{{ ansible_facts['user_dir'] }}/.config/user-dirs.dirs"
|
|
owner: root
|
|
group: root
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
tags:
|
|
- default
|
|
- create_xdg_config
|
|
- locals_exclusive
|
|
- name: Start SSH configuration tasks if current host in specified group
|
|
when: "personal_computers in group_names or ansible_connection == 'local'"
|
|
become: yes
|
|
block:
|
|
- name: Create user SSH configuration
|
|
ansible.builtin.copy:
|
|
src: "files/locals/ssh/{{ ansible_facts['user_id'] }}/config"
|
|
dest: "{{ ansible_facts['user_dir'] }}/.ssh/config"
|
|
follow: yes
|
|
force: yes
|
|
backup: yes
|
|
owner: "{{ ansible_facts['user_id'] }}"
|
|
group: "{{ ansible_facts['user_id'] }}"
|
|
mode: "0600"
|
|
state: present
|
|
tags:
|
|
- default
|
|
- create_ssh_config
|
|
- locals_exclusive
|
|
- name: Import GPG private keys
|
|
ansible.builtin.include_role:
|
|
name: lockdown
|
|
defaults_from: main
|
|
vars_from: main
|
|
handlers_from: main
|
|
tasks_from: gpg
|
|
vars:
|
|
gpg_keys_origin_host: localhost
|
|
gpg_origin_private_key_passwords: "{{ gpg_import_passwords | split(' : ') }}"
|
|
tags:
|
|
- default
|
|
- import_gpg_privkeys
|
|
# @TODO separate below task as lockdown role task, and maybe associated variables to lockdown role defaults/vars dirs
|
|
# @NOTE below depends on variable 'gpg_signing_key' and 'gpg_or_ssh_git_signing' from 'vars_prompt' playbook field
|
|
# @NOTE below depends on variable 'gpg_origin_private_keyids' and 'files_mode' found in lockdown role defaults/vars dirs
|
|
- name: Install and configure git
|
|
block:
|
|
- name: Install git package
|
|
ansible.builtin.package:
|
|
name: git
|
|
state: latest
|
|
- name: Configure git installation
|
|
block:
|
|
- name: Configure git name
|
|
community.general.git_config:
|
|
name: user.name
|
|
scope: global
|
|
state: present
|
|
value: "{{ git_config_name }}"
|
|
- name: Configure git email
|
|
community.general.git_config:
|
|
name: user.email
|
|
scope: global
|
|
state: present
|
|
value: "{{ git_config_email }}"
|
|
- name: Configure git signing key
|
|
block:
|
|
- name: Configure git signing GPG key
|
|
when: gpg_or_ssh_git_signing == "gpg"
|
|
block:
|
|
- name: Configure specified git signing GPG key
|
|
when: gpg_preferred_signing > -1
|
|
community.general.git_config:
|
|
name: user.signingkey
|
|
scope: global
|
|
state: present
|
|
value: "{{ gpg_origin_private_keyids[gpg_preferred_signing] }}"
|
|
- name: Configure random git signing GPG key
|
|
when: gpg_preferred_signing <= -1
|
|
community.general.git_config:
|
|
name: user.signingkey
|
|
scope: global
|
|
state: present
|
|
value: "{{ gpg_origin_private_keyids | random }}"
|
|
register: randomized_gpg_key_preference
|
|
- name: Configure git signing SSH key
|
|
when: gpg_or_ssh_git_signing == "ssh"
|
|
block:
|
|
- name: Acquire SSH key-pairs from other system
|
|
when: not files_mode
|
|
block:
|
|
- name: Acquire private SSH keys from other system
|
|
delegate_to: "{{ ssh_keypairs_origin_host }}" # @TODO variable needs declaration/definition
|
|
ansible.builtin.command:
|
|
argv:
|
|
- cat
|
|
- ~/.ssh/"{{ item }}.ppk"
|
|
loop: "{{ ssh_origin_keypairs_paths }}" # @TODO variable needs declaration/definition--should have max 2 items each without file extension, with private and then public keys having same basename
|
|
register: ssh_secrets
|
|
- name: Find SSH public keys in other system
|
|
delegate_to: "{{ ssh_keypairs_origin_host }}" # @TODO variable needs declaration/definition
|
|
ansible.builtin.command:
|
|
argv:
|
|
- cat
|
|
- ~/.ssh/"{{ item }}.pub"
|
|
loop: "{{ ssh_origin_keypairs_paths }}" # @TODO variable needs declaration/definition--should have max 2 items each without file extension, with private and then public keys having same basename
|
|
register: ssh_nonsecrets
|
|
- name: Create private SSH keys
|
|
ansible.builtin.copy:
|
|
content: "{{ item }}"
|
|
dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.ppk"
|
|
force: yes
|
|
backup: yes
|
|
mode: "0600"
|
|
state: present
|
|
loop: "{{ ssh_secrets.results }}"
|
|
register: created_ssh_private_keys
|
|
- name: Create public SSH keys
|
|
ansible.builtin.copy:
|
|
content: "{{ item }}"
|
|
dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.pub"
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
loop: "{{ ssh_nonsecrets.results }}"
|
|
register: created_ssh_public_keys
|
|
- name: Acquire SSH key-pairs
|
|
when: files_mode
|
|
block:
|
|
- name: Transfer private SSH keys
|
|
ansible.builtin.copy:
|
|
src: files/all/ssh/id_ed25519_git.ppk # @TODO change path if and when moved into lockdown role task file and create corresponding file in lockdown role files dir
|
|
dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.ppk"
|
|
force: yes
|
|
backup: yes
|
|
mode: "0600"
|
|
state: present
|
|
register: created_ssh_private_key
|
|
- name: Transfer public SSH keys
|
|
ansible.builtin.copy:
|
|
src: files/all/ssh/id_ed25519_git.pub # @TODO change path if and when moved into lockdown role task file and create corresponding file in lockdown role files dir
|
|
dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.pub"
|
|
force: yes
|
|
backup: yes
|
|
mode: "0644"
|
|
state: present
|
|
register: created_ssh_public_key
|
|
- name: Configure acquired, specified SSH public key as git signing key
|
|
when: ssh_preferred_signing > -1 and not files_mode
|
|
community.general.git_config:
|
|
name: user.signingkey
|
|
scope: global
|
|
state: present
|
|
value: "{{ created_ssh_public_keys.results[ssh_preferred_signing] }}" # @TODO this variable needs declaration/definition
|
|
- name: Configure acquired, random SSH public key as git signing key
|
|
when: ssh_preferred_signing <= -1 and not files_mode
|
|
community.general.git_config:
|
|
name: user.signingkey
|
|
scope: global
|
|
state: present
|
|
value: "{{ created_ssh_public_keys.results | random }}" # @TODO this variable needs declaration/definition
|
|
register: randomized_ssh_pubkey_preference
|
|
- name: Configure transferred SSH public key as git signing key
|
|
when: ssh_preferred_signing <= -1 and files_mode
|
|
community.general.git_config:
|
|
name: user.signingkey
|
|
scope: global
|
|
state: present
|
|
value: "{{ created_ssh_public_key.dest }}"
|
|
|
|
|