mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Fable 5
cc7662fe3a
Model change: per-user 'reserved: true|false' becomes 'accounts', a list of host/mailbox/identity account types. Default when absent derives from roles (bot/administrator -> [mailbox, identity], else [identity]) both for role-file users and — via _apply_account_defaults after the inventory merge — for inventory-only users, so users like biber keep their LDAP/Keycloak accounts. Auto-generated role-suffix reservations get accounts: []. New 'forward' field: mailu creates <username>@domain -> forward user's email via the new 04b_manage_alias.yml (create-only; no_log on the loop so user dicts never hit the log). Mailbox creation and password rotation now gate on 'mailbox' in accounts instead of role names; the mailu rbac role is renamed mail-bot -> bot (token gate included). svc-db-openldap drops the provision.reserved flag; OPENLDAP_USERS is always the identity subset. reserved_usernames/non_reserved_users now classify by 'identity' in accounts, keeping the Keycloak deny-list semantics. root/backup pin accounts: [host], administrator [host, mailbox, identity], helpdesk [mailbox]. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
168 lines
3.3 KiB
YAML
168 lines
3.3 KiB
YAML
---
|
|
sld:
|
|
description: Auto Generated Account to reserve the SLD
|
|
username: "{{ DOMAIN_PRIMARY.split('.')[0] }}"
|
|
accounts: []
|
|
tld:
|
|
description: Auto Generated Account to reserve the TLD
|
|
username: "{{ DOMAIN_PRIMARY.split('.')[1] if (DOMAIN_PRIMARY is defined and (DOMAIN_PRIMARY.split('.') | length) > 1) else (DOMAIN_PRIMARY ~ '_tld ') }}"
|
|
accounts: []
|
|
root:
|
|
username: root
|
|
uid: 0
|
|
gid: 0
|
|
description: System superuser
|
|
accounts: [host]
|
|
daemon:
|
|
username: daemon
|
|
description: Daemon processes owner
|
|
accounts: []
|
|
bin:
|
|
username: bin
|
|
description: Owner of essential binaries
|
|
accounts: []
|
|
sys:
|
|
username: sys
|
|
description: System files owner
|
|
accounts: []
|
|
sync:
|
|
username: sync
|
|
description: Sync user for filesystem synchronization
|
|
accounts: []
|
|
games:
|
|
username: games
|
|
description: Games and educational software owner
|
|
accounts: []
|
|
man:
|
|
username: man
|
|
description: Manual pages viewer
|
|
accounts: []
|
|
lp:
|
|
username: lp
|
|
description: Printer spooler
|
|
accounts: []
|
|
mail:
|
|
username: mail
|
|
description: Mail system
|
|
accounts: []
|
|
news:
|
|
username: news
|
|
description: Network news system
|
|
accounts: []
|
|
uucp:
|
|
username: uucp
|
|
description: UUCP system
|
|
accounts: []
|
|
proxy:
|
|
username: proxy
|
|
description: Proxy user
|
|
accounts: []
|
|
backup:
|
|
username: backup
|
|
description: Backup operator
|
|
accounts: [host]
|
|
list:
|
|
username: list
|
|
description: Mailing list manager
|
|
accounts: []
|
|
irc:
|
|
username: irc
|
|
description: IRC services user
|
|
accounts: []
|
|
gnats:
|
|
username: gnats
|
|
description: GNATS bug-reporting system
|
|
accounts: []
|
|
nobody:
|
|
username: nobody
|
|
description: Unprivileged user
|
|
accounts: []
|
|
messagebus:
|
|
username: messagebus
|
|
description: D-Bus message bus system
|
|
accounts: []
|
|
sshd:
|
|
username: sshd
|
|
description: SSH daemon
|
|
accounts: []
|
|
rpc:
|
|
username: rpc
|
|
description: Rpcbind daemon
|
|
accounts: []
|
|
ftp:
|
|
username: ftp
|
|
description: FTP server
|
|
accounts: []
|
|
postfix:
|
|
username: postfix
|
|
description: Postfix mail transfer agent
|
|
accounts: []
|
|
mysql:
|
|
username: mysql
|
|
description: MySQL database server
|
|
accounts: []
|
|
mongodb:
|
|
username: mongodb
|
|
description: MongoDB database server
|
|
accounts: []
|
|
admin:
|
|
username: admin
|
|
description: Generic reserved username
|
|
accounts: []
|
|
user:
|
|
username: user
|
|
description: Generic reserved username
|
|
accounts: []
|
|
test:
|
|
username: test
|
|
description: Generic reserved username
|
|
accounts: []
|
|
guest:
|
|
username: guest
|
|
description: Generic reserved username
|
|
accounts: []
|
|
demo:
|
|
username: demo
|
|
description: Generic reserved username
|
|
accounts: []
|
|
info:
|
|
username: info
|
|
description: Generic reserved username
|
|
accounts: []
|
|
support:
|
|
username: support
|
|
description: Generic reserved username
|
|
accounts: []
|
|
helpdesk:
|
|
username: helpdesk
|
|
description: Generic reserved username
|
|
accounts: [mailbox]
|
|
operator:
|
|
username: operator
|
|
description: Generic reserved username
|
|
accounts: []
|
|
staff:
|
|
username: staff
|
|
description: Generic reserved username
|
|
accounts: []
|
|
smtp:
|
|
username: smtp
|
|
description: Generic reserved username
|
|
accounts: []
|
|
imap:
|
|
username: imap
|
|
description: Generic reserved username
|
|
accounts: []
|
|
pop:
|
|
username: pop
|
|
description: Generic reserved username
|
|
accounts: []
|
|
webmaster:
|
|
username: webmaster
|
|
description: Generic reserved username
|
|
accounts: []
|
|
mailman:
|
|
username: mailman
|
|
description: Generic reserved username
|
|
accounts: []
|