mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-12-02 07:38:22 +00:00
Kevin Veen-Birkenbach
e09f561f0b
- Replace legacy utils/run_once.yml with the new helpers utils/once_flag.yml and utils/once_finalize.yml - Introduce utils/compose_up.yml to ensure docker-compose stacks are up and to flush handlers safely without coupling to run-once flags - Migrate all affected roles (desk-*, dev-*, sys-ctl-*, sys-svc-*, web-app-*, web-svc-*, util-*) to the new run-once helpers - Rework sys-svc-msmtp to auto-load Mailu once per deploy, check reachability, and reuse the running stack instead of requiring multiple playbook passes - Adjust web-app-mailu to integrate cert deployment, handler flushing, and run-once handling so Mailu is fully initialized in a single deploy - Improve Matomo, CDN, logout and CSP/health-check related roles to cooperate with the new compose_up / once_* pattern - Simplify alarm/backup/timer/service orchestration (sys-ctl-alm-*, sys-bkp-provider, sys-timer-cln-bkps, etc.) by moving run-once logic into dedicated 01_core.yml files - Update integration tests so utils/once_flag.yml and utils/once_finalize.yml are recognised as valid run-once providers, keeping the global run_once_* guarantees consistent - Align frontend injection and service dependencies so Mastodon- and Mailu-related services can be brought up coherently within a single deployment cycle rather than several iterations
56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
- name: Include dependency 'sys-sudo'
|
|
include_role:
|
|
name: sys-sudo
|
|
when: run_once_sys_sudo is not defined
|
|
|
|
- name: create administrator
|
|
user:
|
|
name: administrator
|
|
update_password: on_create
|
|
password: "{{ users.administrator.password | password_hash('sha512') }}"
|
|
create_home: yes
|
|
generate_ssh_key: yes
|
|
ssh_key_type: rsa
|
|
ssh_key_bits: 8192
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
|
|
- name: "set correct rights for {{ PATH_ADMINISTRATOR_HOME }}"
|
|
file:
|
|
path: "{{ PATH_ADMINISTRATOR_HOME }}"
|
|
state: directory
|
|
owner: administrator
|
|
group: administrator
|
|
mode: 0700
|
|
|
|
- name: "create {{ PATH_ADMINISTRATOR_SCRIPTS }}"
|
|
file:
|
|
path: "{{ PATH_ADMINISTRATOR_HOME }}scripts"
|
|
state: directory
|
|
owner: administrator
|
|
group: administrator
|
|
mode: 0700
|
|
|
|
- name: create {{ PATH_ADMINISTRATOR_HOME }}.ssh/authorized_keys
|
|
copy:
|
|
src: "{{ inventory_dir }}/files/{{ inventory_hostname }}{{ PATH_ADMINISTRATOR_HOME }}.ssh/authorized_keys"
|
|
dest: "{{ PATH_ADMINISTRATOR_HOME }}.ssh/authorized_keys"
|
|
owner: administrator
|
|
group: administrator
|
|
mode: '0644'
|
|
|
|
- name: grant administrator sudo rights with password
|
|
copy:
|
|
src: "administrator"
|
|
dest: /etc/sudoers.d/administrator
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
notify: sshd restart
|
|
|
|
- name: "embed user routines for {{ role_path | basename }}"
|
|
include_role:
|
|
name: user
|
|
vars:
|
|
user_name: "administrator"
|
|
|
|
- include_tasks: utils/once_flag.yml |