updates

inventory/prod/group_vars/all/users.yml

@@ -9,23 +9,16 @@
 
 users_admin_groups:
   super_admin:
-    - username: s.lebed
+    - username: mrwho
       ssh_key: >-
-        ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChuu3tibT89C77sjX19kqqfr3qqM1eknqipnvZzd23cZTn8ULyWLLmOSYiEuOP5fcz55PVOpe8k8eBC+JvCu+/W1XdPH/q7GCL00b0ANcMKMZHvi/zjFSZj7NoFeypVF4/dutTWudpftFdmfJdHt5wyFs37cVNc4WWbNSASQBHhzR3GSdq7h5H5Ed0ua6AIFNR9Mt0rFI5JYbMaU/mO5WvvrlIq4T1X1zpHUDPloFXmnWd+WPuGPR7ecHP0mmXYSoWDCjEBexCUiAPb9BhR7dbe9lDjWwDB3J9daKXQ9rFpZ6f91DyD6sImarJSmTYXHnAn3u/Hj3IW5TYW4XMypob+NIRa3o7Zuu0rZ2uqwFdSxe9sOJHkgxTxwnJpBxRsQCpAl4uyGGOmTUiYDY7rK86zk1e4xetwt7DS16WOqdrBSNw6sKmvAtkcxacmbOO68+ixmWERpbFXuJtuCQodOtgf+vGUbXASJ1RQtmrBP0qKbV+MYqMOLP1RPA6UUeYssA/lG0uO4u7xxAW30MExZjeETgzGONbSBshqwFt09aXYs57Esp+kn4cFYcYkhvbPeicFiaCwQ4RWd+iAryd6KFNFrc0o0TuqbwE+3Dba2dU3P2KQ+nVIYGeDs62OyYV0yCN0ZEHDzkJAsbqNMDVpwCv4YdZdg0iB40aednRzNYv3Q== s.lebed@gigacoms.ru
+        ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlQz8IhTEQ0utmWmwOC7FijieQULbeyXLDkjmYwSyptqj+7u0qyPPStQzN9leIISSKJ1/eJ5UbETTvc1R1Jg1tdTg5xZTMoz0jwruDP73vYIxLdeO4cZvjJIGyzS2PemUM+016uf4DLZ3jmK4hwEi2mF6UX+NYRPNIuPpr96gP1kYb1vrlG7P0cEk7EbGO6Deda3S64L0lDherSqc/Z7cn8nr6iemTdsBfl303vqFgXf/aWijuvVPUSpSiI3fR0NwvX/RW7oDIFls1dVU5CPkcwaX25Fu3voJ6e3lmduW+1s/vL1nMd5ourET+1Std3S75jqzkVsV3R74Xkgq5avn7w==
 
-    - username: a.kazantsev
-      # Note: key comment says a.kazantsev — verify the key owner if needed
-      ssh_key: >-
-        ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClB+roxcr/POfhJVq3jFIzZD36nRVhfYq9WaQBr6o2RvMHM+B/2yRM8OeN6jhhYYFB8z7X5o8j1/ZC2u/80LLJtEQ0s8DCb4l4Ie7IY3POBYlmwtvlnhNFsGlKoAoQr0jpPUwMiV7wdBtHYCqHJM69+VpWCnqOkI+hrdj5oxSm26g6AKL0lm9AJO8KnbIpUCHgnQ3EcPcfQE7OpspVP6nbp4SwipJbnG4yYeKB6l77ESUdCkgwwLCv4DCpxJ846J9aN39Bu273hmEoO6+Bw0wAPRruLp5/AzPni7frcncdGuPfOmi+RAoOsRqoO/c122soAbQn3074QtEKwuC+zFKH a.kazantsev@gigacoms.ru
-
-  middle_admin:
-    []
+  middle_admin: []
     # Example:
     # - username: m.ivanov
     #   ssh_key: "ssh-rsa AAAA..."
 
-  junior_admin:
-    []
+  junior_admin: []
     # Example:
     # - username: j.petrov
     #   ssh_key: "ssh-rsa AAAA..."

playbooks/rocky9.yml

@@ -12,5 +12,6 @@
     reboot_system: false
     #hostname: rocky9-template.local.mrwho.ru
   roles:
+    - users
     - rocky9
     - root-cert

roles/rocky9/tasks/ip_bridge.yml

@@ -7,15 +7,18 @@
     value: 0
     state: present
     sysctl_file: /etc/sysctl.d/ip_bridge.conf
+  ignore_errors: true
 - name: net.bridge.bridge-nf-call-iptables
   ansible.posix.sysctl:
     name: net.bridge.bridge-nf-call-iptables
     value: 0
     state: present
     sysctl_file: /etc/sysctl.d/ip_bridge.conf
+  ignore_errors: true
 - name: net.bridge.bridge-nf-call-arptables
   ansible.posix.sysctl:
     name: net.bridge.bridge-nf-call-arptables
     value: 0
     state: present
     sysctl_file: /etc/sysctl.d/ip_bridge.conf
+  ignore_errors: true

roles/rocky9/tasks/main.yml

@@ -12,13 +12,11 @@
     group: root
     mode: "0644"
 
-- name: Create users
-  ansible.builtin.include_tasks:
-    file: create_users.yml
+#- name: Create users
+#  ansible.builtin.include_tasks: create_users.yml
 
 - name: Syctl tuning
-  ansible.builtin.include_tasks:
-    file: sysctl_tuning.yml
+  ansible.builtin.include_tasks: sysctl_tuning.yml
 
 # - name: Setup NIC to eth0
 #   ansible.builtin.include_tasks:

roles/root-cert/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+install_root_cert_pem: root_ca.crt

roles/users/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+# Группа sudo по умолчанию — переопределяется в group_vars для конкретной ОС
+users_sudo_group: sudo
+
+# По умолчанию разрешены все группы администраторов (переопределяется для конкретного хоста/группы)
+users_allowed_admin_groups:
+  - super_admin
+  - middle_admin
+  - junior_admin
+
+# Все группы администраторов — заполняются из inventory/group_vars
+users_admin_groups:
+  super_admin: []
+  middle_admin: []
+  junior_admin: []

roles/users/meta/main.yml

@@ -0,0 +1,15 @@
+---
+galaxy_info:
+  role_name: users
+  author: ops
+  description: Provision admin user accounts with SSH keys and passwordless sudo
+  license: MIT
+  min_ansible_version: "2.14"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+    - name: EL
+      versions:
+        - "7"
+dependencies: []

roles/users/tasks/main.yml

@@ -0,0 +1,87 @@
+---
+# Формирование плоского списка пользователей, которые должны существовать на ЭТОМ хосте,
+# путём выборки только тех групп администраторов, что указаны в `users_allowed_admin_groups`.
+- name: Build list of users to manage on this host
+  ansible.builtin.set_fact:
+    users_managed_users: >-
+      {{
+        users_allowed_admin_groups
+        | map('extract', users_admin_groups)
+        | flatten
+        | unique
+      }}
+
+- name: Show managed users for this host
+  ansible.builtin.debug:
+    msg: "Managing users: {{ users_managed_users | map(attribute='username') | list }}"
+
+# ── Необходимые пакеты ────────────────────────────────────────────────────────
+- name: Update apt cache (Debian/Ubuntu)
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+  when: ansible_os_family == "Debian"
+  failed_when: false
+
+- name: Ensure sudo package is present (Debian/Ubuntu)
+  ansible.builtin.apt:
+    name: sudo
+    state: present
+  when: ansible_os_family == "Debian"
+
+# ── Учётные записи пользователей ──────────────────────────────────────────────
+- name: Ensure user accounts exist
+  ansible.builtin.user:
+    name: "{{ item.username }}"
+    state: present
+    shell: /bin/bash
+    create_home: true
+  loop: "{{ users_managed_users }}"
+  loop_control:
+    label: "{{ item.username }}"
+
+# ── Членство в группах ────────────────────────────────────────────────────────
+- name: Add users to privileged group ({{ users_sudo_group }})
+  ansible.builtin.user:
+    name: "{{ item.username }}"
+    groups: "{{ users_sudo_group }}"
+    append: true
+  loop: "{{ users_managed_users }}"
+  loop_control:
+    label: "{{ item.username }}"
+
+# ── Sudo без пароля ───────────────────────────────────────────────────────────
+- name: Remove legacy sudoers files with dots in name
+  ansible.builtin.file:
+    path: /etc/sudoers.d/{{ item.username }}
+    state: absent
+  loop: "{{ users_managed_users }}"
+  loop_control:
+    label: "{{ item.username }}"
+  when: "'.' in item.username"
+
+- name: Configure passwordless sudo via sudoers.d
+  ansible.builtin.copy:
+    content: "{{ item.username }} ALL=(ALL) NOPASSWD:ALL\n"
+    dest: /etc/sudoers.d/{{ item.username | replace('.', '_') }}
+    owner: root
+    group: root
+    mode: "0440"
+    validate: visudo -cf %s
+  loop: "{{ users_managed_users }}"
+  loop_control:
+    label: "{{ item.username }}"
+
+# ── SSH-ключи ─────────────────────────────────────────────────────────────────
+- name: Deploy SSH authorized keys
+  ansible.posix.authorized_key:
+    user: "{{ item.username }}"
+    key: "{{ item.ssh_key }}"
+    state: present
+    exclusive: false
+  loop: "{{ users_managed_users }}"
+  loop_control:
+    label: "{{ item.username }}"
+  when:
+    - item.ssh_key is defined
+    - item.ssh_key | length > 0