kevinveenbirkenbachandClaude Opus 5
93b47a5bee
Replaces the raw package modules at 76 call sites with package_install, moves each role's distribution mapping into its own meta/packages.yml, and turns the inventory PACKAGES variable from source-keyed literal names into a list of declared package ids. The lint that forbids the raw modules is enabled here, because the migration burns it down from 76 offenders to zero. Removes sys-aur, sys-aur-install and sys-package. The AUR build user, the passwordless pacman rule and the inventory-driven install are part of the plan the action plugin executes, so the roles no longer carry them. Declaring the mappings surfaced breakage the raw modules had hidden: on Debian the `which` binary comes from debianutils, jrnl is in no Debian or Ubuntu suite, chromium-browser is absent from Debian stable, JDK 11 is unobtainable on RedHat, wireguard had no RedHat branch at all, qbittorrent was built from the AUR although Arch ships it in extra, and desk-docker installed a Docker variant that conflicts with the one sys-svc-container installs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sudo
Description
This role installs the sudo package and deploys a default sudoers file to ensure secure and consistent privilege escalation on the target system. It uses a preconfigured sudoers file that follows best practices and includes directives to read drop-in files from /etc/sudoers.d.
Overview
Optimized for security and ease of administration, this role guarantees that sudo is installed and configured according to recommended practices. The provided sudoers file includes essential comments, host/user aliases, and defaults to help prevent misconfigurations.
Cosmos
The diagram places Sudo in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
flowchart LR
subgraph role [sys-sudo 💻]
svc_sudo["sudo"]
end
Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments). Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.
Purpose
The primary purpose of this role is to ensure that the target system has a reliable sudo configuration. By installing the sudo package and deploying a standard sudoers file, the role facilitates proper administrative access and minimizes potential security risks.
Features
- Sudo Package Installation: Installs the sudo package if it is not already present.
- Default Sudoers Configuration: Deploys a default sudoers file with best-practice settings.
- Drop-in Inclusion: Ensures that configuration files from
/etc/sudoers.dare included. - Security Focus: Provides commented guidelines to avoid common sudo misconfigurations.
Credits
Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).