mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-12-09 10:56:01 +00:00
Kevin Veen-Birkenbach
26dfab147d
Add end-to-end support for reserved usernames and tighten CAPTCHA / Keycloak logic.
Changes:
- Makefile: rename EXTRA_USERS → RESERVED_USERNAMES and pass it as --reserved-usernames to the users defaults generator.
- cli/build/defaults/users.py: propagate flag into generated users, add --reserved-usernames CLI option and mark listed accounts as reserved.
- Add reserved_users filter plugin with and helpers for Ansible templates and tasks.
- Add unit tests for reserved_users filters and the new reserved-usernames behaviour in the users defaults generator.
- group_vars/all/00_general.yml: harden RECAPTCHA_ENABLED / HCAPTCHA_ENABLED checks with default('') and explicit > 0 length checks.
- svc-db-openldap: introduce OPENLDAP_PROVISION_* flags, add OPENLDAP_PROVISION_RESERVED and OPERNLDAP_USERS to optionally exclude reserved users from provisioning.
- svc-db-openldap templates/tasks: switch role/group LDIF and user import loops to use OPERNLDAP_USERS instead of the full users dict.
- networks: assign dedicated subnet for web-app-roulette-wheel.
- web-app-keycloak vars: compute KEYCLOAK_RESERVED_USERNAMES_LIST and KEYCLOAK_RESERVED_USERNAMES_REGEX from users | reserved_usernames.
- web-app-keycloak user profile template: inject reserved-username regex into username validation pattern and improve error message, fix SSH public key attribute usage and add component name field.
- web-app-keycloak update/_update.yml: strip subComponents from component payloads before update and disable async/poll for easier debugging.
- web-app-keycloak tasks/main.yml: guard cleanup include with MODE_CLEANUP and keep reCAPTCHA update behind KEYCLOAK_RECAPTCHA_ENABLED.
- user/users defaults: mark system/service accounts (root, daemon, mail, admin, webmaster, etc.) as reserved so they cannot be chosen as login names.
- svc-prx-openresty vars: simplify OPENRESTY_CONTAINER lookup by dropping unused default parameter.
- sys-ctl-rpr-btrfs-balancer: simplify main.yml by removing the extra block wrapper.
- sys-daemon handlers: quote handler name for consistency.
Context: change set discussed and refined in ChatGPT on 2025-11-29 (Infinito.Nexus reserved usernames & Keycloak user profile flow). See conversation: https://chatgpt.com/share/692b21f5-5d98-800f-8e15-1ded49deddc9
53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
- name: collect systemd unit files
|
|
shell: |
|
|
shopt -s nullglob
|
|
files=({{ PATH_SYSTEM_SERVICE_DIR }}*.service {{ PATH_SYSTEM_SERVICE_DIR }}*.timer)
|
|
printf "%s\n" "${files[@]}"
|
|
args:
|
|
executable: /bin/bash
|
|
register: _unit_files
|
|
changed_when: false
|
|
failed_when: false
|
|
become: true
|
|
listen:
|
|
- reload system daemon
|
|
- reexec systemd manager
|
|
|
|
- name: validate systemd units
|
|
shell: |
|
|
systemd-analyze verify {{ _unit_files.stdout_lines | join(' ') }}
|
|
register: _verify_units
|
|
changed_when: false
|
|
failed_when: _unit_files.stdout | length > 0 and _verify_units.rc != 0
|
|
become: true
|
|
when: _unit_files.stdout | length > 0
|
|
listen:
|
|
- reload system daemon
|
|
- reexec systemd manager
|
|
|
|
- name: show merged manager config
|
|
command: systemd-analyze cat-config systemd/system.conf
|
|
register: _catcfg
|
|
changed_when: false
|
|
become: true
|
|
listen:
|
|
- reload system daemon
|
|
- reexec systemd manager
|
|
|
|
- name: "reload system daemon"
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
become: true
|
|
listen: reload system daemon
|
|
async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
|
|
poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
|
|
|
|
- name: reexec systemd manager
|
|
# Just execute this during reset, it has potential dangerous side effects
|
|
ansible.builtin.systemd:
|
|
daemon_reexec: true
|
|
become: true
|
|
listen: reexec systemd manager
|
|
async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
|
|
poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}"
|