diff --git a/inventory/prod/group_vars/all/users.yml b/inventory/prod/group_vars/all/users.yml index 2279a88..b71aa44 100644 --- a/inventory/prod/group_vars/all/users.yml +++ b/inventory/prod/group_vars/all/users.yml @@ -9,23 +9,16 @@ users_admin_groups: super_admin: - - username: s.lebed + - username: mrwho ssh_key: >- - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChuu3tibT89C77sjX19kqqfr3qqM1eknqipnvZzd23cZTn8ULyWLLmOSYiEuOP5fcz55PVOpe8k8eBC+JvCu+/W1XdPH/q7GCL00b0ANcMKMZHvi/zjFSZj7NoFeypVF4/dutTWudpftFdmfJdHt5wyFs37cVNc4WWbNSASQBHhzR3GSdq7h5H5Ed0ua6AIFNR9Mt0rFI5JYbMaU/mO5WvvrlIq4T1X1zpHUDPloFXmnWd+WPuGPR7ecHP0mmXYSoWDCjEBexCUiAPb9BhR7dbe9lDjWwDB3J9daKXQ9rFpZ6f91DyD6sImarJSmTYXHnAn3u/Hj3IW5TYW4XMypob+NIRa3o7Zuu0rZ2uqwFdSxe9sOJHkgxTxwnJpBxRsQCpAl4uyGGOmTUiYDY7rK86zk1e4xetwt7DS16WOqdrBSNw6sKmvAtkcxacmbOO68+ixmWERpbFXuJtuCQodOtgf+vGUbXASJ1RQtmrBP0qKbV+MYqMOLP1RPA6UUeYssA/lG0uO4u7xxAW30MExZjeETgzGONbSBshqwFt09aXYs57Esp+kn4cFYcYkhvbPeicFiaCwQ4RWd+iAryd6KFNFrc0o0TuqbwE+3Dba2dU3P2KQ+nVIYGeDs62OyYV0yCN0ZEHDzkJAsbqNMDVpwCv4YdZdg0iB40aednRzNYv3Q== s.lebed@gigacoms.ru + ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAlQz8IhTEQ0utmWmwOC7FijieQULbeyXLDkjmYwSyptqj+7u0qyPPStQzN9leIISSKJ1/eJ5UbETTvc1R1Jg1tdTg5xZTMoz0jwruDP73vYIxLdeO4cZvjJIGyzS2PemUM+016uf4DLZ3jmK4hwEi2mF6UX+NYRPNIuPpr96gP1kYb1vrlG7P0cEk7EbGO6Deda3S64L0lDherSqc/Z7cn8nr6iemTdsBfl303vqFgXf/aWijuvVPUSpSiI3fR0NwvX/RW7oDIFls1dVU5CPkcwaX25Fu3voJ6e3lmduW+1s/vL1nMd5ourET+1Std3S75jqzkVsV3R74Xkgq5avn7w== - - username: a.kazantsev - # Note: key comment says a.kazantsev — verify the key owner if needed - ssh_key: >- - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClB+roxcr/POfhJVq3jFIzZD36nRVhfYq9WaQBr6o2RvMHM+B/2yRM8OeN6jhhYYFB8z7X5o8j1/ZC2u/80LLJtEQ0s8DCb4l4Ie7IY3POBYlmwtvlnhNFsGlKoAoQr0jpPUwMiV7wdBtHYCqHJM69+VpWCnqOkI+hrdj5oxSm26g6AKL0lm9AJO8KnbIpUCHgnQ3EcPcfQE7OpspVP6nbp4SwipJbnG4yYeKB6l77ESUdCkgwwLCv4DCpxJ846J9aN39Bu273hmEoO6+Bw0wAPRruLp5/AzPni7frcncdGuPfOmi+RAoOsRqoO/c122soAbQn3074QtEKwuC+zFKH a.kazantsev@gigacoms.ru - - middle_admin: - [] + middle_admin: [] # Example: # - username: m.ivanov # ssh_key: "ssh-rsa AAAA..." - junior_admin: - [] + junior_admin: [] # Example: # - username: j.petrov # ssh_key: "ssh-rsa AAAA..." diff --git a/playbooks/rocky9.yml b/playbooks/rocky9.yml index bbcf188..943e8f0 100644 --- a/playbooks/rocky9.yml +++ b/playbooks/rocky9.yml @@ -12,5 +12,6 @@ reboot_system: false #hostname: rocky9-template.local.mrwho.ru roles: + - users - rocky9 - root-cert diff --git a/roles/rocky9/tasks/ip_bridge.yml b/roles/rocky9/tasks/ip_bridge.yml index d6c312c..44d26a1 100644 --- a/roles/rocky9/tasks/ip_bridge.yml +++ b/roles/rocky9/tasks/ip_bridge.yml @@ -7,15 +7,18 @@ value: 0 state: present sysctl_file: /etc/sysctl.d/ip_bridge.conf + ignore_errors: true - name: net.bridge.bridge-nf-call-iptables ansible.posix.sysctl: name: net.bridge.bridge-nf-call-iptables value: 0 state: present sysctl_file: /etc/sysctl.d/ip_bridge.conf + ignore_errors: true - name: net.bridge.bridge-nf-call-arptables ansible.posix.sysctl: name: net.bridge.bridge-nf-call-arptables value: 0 state: present sysctl_file: /etc/sysctl.d/ip_bridge.conf + ignore_errors: true diff --git a/roles/rocky9/tasks/main.yml b/roles/rocky9/tasks/main.yml index ba9b652..cdcd709 100644 --- a/roles/rocky9/tasks/main.yml +++ b/roles/rocky9/tasks/main.yml @@ -12,13 +12,11 @@ group: root mode: "0644" -- name: Create users - ansible.builtin.include_tasks: - file: create_users.yml +#- name: Create users +# ansible.builtin.include_tasks: create_users.yml - name: Syctl tuning - ansible.builtin.include_tasks: - file: sysctl_tuning.yml + ansible.builtin.include_tasks: sysctl_tuning.yml # - name: Setup NIC to eth0 # ansible.builtin.include_tasks: diff --git a/roles/root-cert/defaults/main.yml b/roles/root-cert/defaults/main.yml new file mode 100644 index 0000000..d9bbe20 --- /dev/null +++ b/roles/root-cert/defaults/main.yml @@ -0,0 +1,2 @@ +--- +install_root_cert_pem: root_ca.crt \ No newline at end of file diff --git a/roles/users/defaults/main.yml b/roles/users/defaults/main.yml new file mode 100644 index 0000000..e1efa96 --- /dev/null +++ b/roles/users/defaults/main.yml @@ -0,0 +1,15 @@ +--- +# Группа sudo по умолчанию — переопределяется в group_vars для конкретной ОС +users_sudo_group: sudo + +# По умолчанию разрешены все группы администраторов (переопределяется для конкретного хоста/группы) +users_allowed_admin_groups: + - super_admin + - middle_admin + - junior_admin + +# Все группы администраторов — заполняются из inventory/group_vars +users_admin_groups: + super_admin: [] + middle_admin: [] + junior_admin: [] diff --git a/roles/users/meta/main.yml b/roles/users/meta/main.yml new file mode 100644 index 0000000..102e5ba --- /dev/null +++ b/roles/users/meta/main.yml @@ -0,0 +1,15 @@ +--- +galaxy_info: + role_name: users + author: ops + description: Provision admin user accounts with SSH keys and passwordless sudo + license: MIT + min_ansible_version: "2.14" + platforms: + - name: Debian + versions: + - bookworm + - name: EL + versions: + - "7" +dependencies: [] diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml new file mode 100644 index 0000000..15672f2 --- /dev/null +++ b/roles/users/tasks/main.yml @@ -0,0 +1,87 @@ +--- +# Формирование плоского списка пользователей, которые должны существовать на ЭТОМ хосте, +# путём выборки только тех групп администраторов, что указаны в `users_allowed_admin_groups`. +- name: Build list of users to manage on this host + ansible.builtin.set_fact: + users_managed_users: >- + {{ + users_allowed_admin_groups + | map('extract', users_admin_groups) + | flatten + | unique + }} + +- name: Show managed users for this host + ansible.builtin.debug: + msg: "Managing users: {{ users_managed_users | map(attribute='username') | list }}" + +# ── Необходимые пакеты ──────────────────────────────────────────────────────── +- name: Update apt cache (Debian/Ubuntu) + ansible.builtin.apt: + update_cache: true + cache_valid_time: 3600 + when: ansible_os_family == "Debian" + failed_when: false + +- name: Ensure sudo package is present (Debian/Ubuntu) + ansible.builtin.apt: + name: sudo + state: present + when: ansible_os_family == "Debian" + +# ── Учётные записи пользователей ────────────────────────────────────────────── +- name: Ensure user accounts exist + ansible.builtin.user: + name: "{{ item.username }}" + state: present + shell: /bin/bash + create_home: true + loop: "{{ users_managed_users }}" + loop_control: + label: "{{ item.username }}" + +# ── Членство в группах ──────────────────────────────────────────────────────── +- name: Add users to privileged group ({{ users_sudo_group }}) + ansible.builtin.user: + name: "{{ item.username }}" + groups: "{{ users_sudo_group }}" + append: true + loop: "{{ users_managed_users }}" + loop_control: + label: "{{ item.username }}" + +# ── Sudo без пароля ─────────────────────────────────────────────────────────── +- name: Remove legacy sudoers files with dots in name + ansible.builtin.file: + path: /etc/sudoers.d/{{ item.username }} + state: absent + loop: "{{ users_managed_users }}" + loop_control: + label: "{{ item.username }}" + when: "'.' in item.username" + +- name: Configure passwordless sudo via sudoers.d + ansible.builtin.copy: + content: "{{ item.username }} ALL=(ALL) NOPASSWD:ALL\n" + dest: /etc/sudoers.d/{{ item.username | replace('.', '_') }} + owner: root + group: root + mode: "0440" + validate: visudo -cf %s + loop: "{{ users_managed_users }}" + loop_control: + label: "{{ item.username }}" + +# ── SSH-ключи ───────────────────────────────────────────────────────────────── +- name: Deploy SSH authorized keys + ansible.posix.authorized_key: + user: "{{ item.username }}" + key: "{{ item.ssh_key }}" + state: present + exclusive: false + loop: "{{ users_managed_users }}" + loop_control: + label: "{{ item.username }}" + when: + - item.ssh_key is defined + - item.ssh_key | length > 0