mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-10-31 10:19:09 +00:00
Kevin Veen-Birkenbach
a10dd402b8
- Improved get_service_name filter plugin (clearer suffix handling, consistent var names). - Added MODE_ASSERT flag to optionally execute validation/assertion tasks. - Fixed systemd unit handling: consistent use of %I instead of %i, correct escaping of instance names. - Unified on_failure behavior and alarm composer scripts. - Cleaned up redundant logging, handlers, and debug config. - Strengthened sys-service template resolution with assert (only active when MODE_ASSERT). - Simplified timer and suffix handling with get_service_name filter. - Hardened sensitive tasks with no_log. - Added conditional asserts across roles (Keycloak, DNS, Mailu, Discourse, etc.). These changes improve consistency, safety, and validation across the automation stack. Conversation: https://chatgpt.com/share/68a4ae28-483c-800f-b2f7-f64c7124c274
55 lines
1.4 KiB
YAML
55 lines
1.4 KiB
YAML
- name: Include dependency 'sys-sudo'
|
|
include_role:
|
|
name: sys-sudo
|
|
when: run_once_sys_sudo is not defined
|
|
|
|
- name: create administrator
|
|
user:
|
|
name: administrator
|
|
update_password: on_create
|
|
password: "{{ users.administrator.password | password_hash('sha512') }}"
|
|
create_home: yes
|
|
generate_ssh_key: yes
|
|
ssh_key_type: rsa
|
|
ssh_key_bits: 8192
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "set correct rights for {{ PATH_ADMINISTRATOR_HOME }}"
|
|
file:
|
|
path: "{{ PATH_ADMINISTRATOR_HOME }}"
|
|
state: directory
|
|
owner: administrator
|
|
group: administrator
|
|
mode: 0700
|
|
|
|
- name: "create {{ PATH_ADMINISTRATOR_SCRIPTS }}"
|
|
file:
|
|
path: "{{ PATH_ADMINISTRATOR_HOME }}scripts"
|
|
state: directory
|
|
owner: administrator
|
|
group: administrator
|
|
mode: 0700
|
|
|
|
- name: create {{ PATH_ADMINISTRATOR_HOME }}.ssh/authorized_keys
|
|
copy:
|
|
src: "{{ inventory_dir }}/files/{{ inventory_hostname }}{{ PATH_ADMINISTRATOR_HOME }}.ssh/authorized_keys"
|
|
dest: "{{ PATH_ADMINISTRATOR_HOME }}.ssh/authorized_keys"
|
|
owner: administrator
|
|
group: administrator
|
|
mode: '0644'
|
|
|
|
- name: grant administrator sudo rights with password
|
|
copy:
|
|
src: "administrator"
|
|
dest: /etc/sudoers.d/administrator
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
notify: sshd restart
|
|
|
|
- name: "embed user routines for {{ role_path | basename }}"
|
|
include_role:
|
|
name: user
|
|
vars:
|
|
user_name: "administrator"
|