kevinveenbirkenbach/computer-playbook

0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 04:06:42 +00:00

Files

T

History

1bffbc6dbe fix(user): keep the login banner off non-interactive stdout

sshd starts bash in a way that sources ~/.bashrc even for a single remote command, and this file printed its banner unconditionally. Every command Ansible runs over SSH therefore returned the banner ahead of its own output, so a task that parses that output read the banner instead: 25 jobs of run 39082924588 died on the web-app-docs CLI replay, where a health poll answered rc=0 and healthy and still failed 120 of 120 attempts because stdout.strip() no longer equalled healthy.

The replay only started seeing it when it moved from the recipe container to a server over SSH in 9aa65a7731. The role deploys this template with mode 0644 as ~/.bashrc, so it is always sourced and never executed, and the guard's return is safe there.

Taken verbatim from 9d4c631b17 on feature/svc-net-wireguard (PR #323), which diagnosed the same cause two weeks earlier from a different symptom, the Matomo bootstrap asserting on 'unknown': unknown terminal type. The file is byte-identical to that branch's version so the two meet in main without a conflict, including the narration comment its follow-up 385cadc7fa dropped.

Co-Authored-By: Evangelos Tsakoudis <evangelostsakoudis@infinito.nexus>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-10-18 10:02:24 +02:00

README.md

User

Description

This role configures a basic user environment (shell dotfiles and SSH authorized_keys) for a user selected via user_key.

Overview

This role executes common tasks for user environment configuration.

Features

Automated provisioning: Configured by Ansible without manual steps.

Reserved usernames

meta/users.yml lists the usernames that MUST NOT be registered in the identity directory. An entry is marked reserved by carrying accounts: []; consumers read the set through the reserved_usernames filter.

One further reservation per label of DOMAIN_PRIMARY is generated at runtime and keyed domain_label_<n>. A deployment on label-a.tld.test therefore reserves label-a, tld and test, at any domain depth.

User data resolution

User data is resolved via lookup('users', user_key) and referenced via user_key. Callers may pass user_config to override the resolved lookup result for one invocation.

Resolution rules:

user_username is resolved from lookup('users', user_key).username (fallback: user_key)
Home path and ownership are based on user_username
SSH keys are read from lookup('users', user_key).authorized_keys

Required input

user_key

Optional user fields

lookup('users', user_key).username (defaults to user_key)
lookup('users', user_key).authorized_keys (list; may be empty)
optional include-role var user_config to override the lookup result for the current call