Move roles functionnality in sub-roles

9 files changed, 166 insertions, 7 deletions

diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index 6e816c7..5dca08d 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -27,13 +27,14 @@
     group: "{{ group_root }}"
     mode: 0644
 
+- name: copy motd configuration file
+  template:
+    src: motd.j2
+    dest: /etc/motd
+    owner: root
+    group: "{{ group_root }}"
+    mode: 0644
+
 - name: synchronize host hostname with config hostname
   hostname: name="{{ inventory_hostname }}"
 
-- name: retrieve all users
-  shell: awk -F ":" '{ if($3 == 0 || $3 > 999 && $3 < 16000) { print $1 }}' /etc/passwd
-  register: valid_users_shell
-
-- name: change shell to zsh for all valid users
-  user: name="{{ item }}" shell="{{ path_zsh }}"
-  loop: "{{ valid_users_shell.stdout_lines }}"
diff --git a/roles/common/templates/motd.j2 b/roles/common/templates/motd.j2
new file mode 100644
index 0000000..8090ab0
--- /dev/null
+++ b/roles/common/templates/motd.j2
@@ -0,0 +1,13 @@
+{% set sep = "▍" %}
+
+ {{ sep }} rgoncalves.se network
+ {{ sep }}
+ {{ sep }} support :          support@rgoncalves.se
+ {{ sep }} look for changes : git.rgoncalves.se
+
+ {{ sep }} system
+ {{ sep }} 
+ {{ sep }} hostname :         {{ ansible_hostname }}
+ {{ sep }} distribution :     {{ ansible_distribution }} {{ ansible_distribution_version }}
+ {{ sep }} kernel revision :  {{ ansible_kernel }} {{ ansible_kernel_version }}
+
diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml
new file mode 100644
index 0000000..74481e4
--- /dev/null
+++ b/roles/git/tasks/main.yml
@@ -0,0 +1,20 @@
+
+# git ~~ roles/git/tasks/main.yml
+# Init git user and settings
+
+---
+
+- name: create git-only directory
+  file:
+    path: /data/git
+    owner: git
+    group: git
+    state: directory
+    mode: 0741
+
+- name: create git user
+  user:
+    name: git
+    group: git
+    shell: "{{ path_gitshell }}"
+
diff --git a/roles/ssh_dns/tasks/main.yml b/roles/ssh_dns/tasks/main.yml
new file mode 100644
index 0000000..60a21bd
--- /dev/null
+++ b/roles/ssh_dns/tasks/main.yml
@@ -0,0 +1,8 @@
+
+# ssh ~~ tasks/local_dns.yml
+
+- name: Generate template to localhost
+  template:
+    src: templates/generate_dns.j2
+    dest: "{{ lookup('env', 'HOME') }}/.ssh/config.d/ssh_dns"
+  delegate_to: 127.0.0.1
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
new file mode 100644
index 0000000..0969429
--- /dev/null
+++ b/roles/sshd/tasks/main.yml
@@ -0,0 +1,24 @@
+
+# sshd ~~ roles/sshd/tasks/main.yml
+# Create sshd configuration and restart daemon
+
+---
+
+- name: generate sshd configuration
+  template:
+    src: templates/sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    owner: "{{ user_root }}"
+    group: "{{ group_root }}"
+    mode: 0644
+
+- name: restart sshd
+  service:
+    name: sshd
+    state: restarted
+
+- name: check ssh connection
+  wait_for:
+    port: 22
+    delay: 1
+    state: started
diff --git a/roles/sshd/templates/generate_dns.j2 b/roles/sshd/templates/generate_dns.j2
new file mode 100644
index 0000000..5d58ae9
--- /dev/null
+++ b/roles/sshd/templates/generate_dns.j2
@@ -0,0 +1,24 @@
+
+# ssh configuration for dns ~~ ~/.ssh/.config.d/
+# managed by Ansible
+
+{% for h in groups["all"] %}
+{% set h = hostvars[h] %}
+{##}
+{% if h.ip is defined and h.services is defined %}
+{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %}
+{##}
+# {{ h.ansible_host }}
+
+Match originalhost {{ h.ansible_host }} exec "ls /sys/class/net/{{ _i.dcontroller }} && ! ping -c 1 -W 5 {{ h.ip.out }}"
+	HostName {{ h.ip.in }}
+	Port {{ _port }}
+
+Match originalhost {{ h.ansible_host }}
+	HostName {{ h.ip.out  }}
+	Port {{ _port }}
+	User root
+
+{% endif %}
+{##}
+{% endfor %}
diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2
new file mode 100644
index 0000000..a11268e
--- /dev/null
+++ b/roles/sshd/templates/sshd_config.j2
@@ -0,0 +1,25 @@
+
+# ssh ~~ /etc/ssh/sshd_config
+# managed by Ansible
+
+# security
+PermitRootLogin yes
+MaxAuthTries 6
+MaxSessions 10
+
+# auth
+AuthorizedKeysFile .ssh/authorized_keys
+PasswordAuthentication no
+PermitEmptyPasswords no
+ClientAliveInterval 180
+
+
+{% if ansible_facts["os_family"] == "OpenBSD" or ansible_facts["os_family"] == "Alpine" %}
+Subsystem sftp /usr/libexec/sftp-server
+{% elif ansible_facts["os_family"] == "Debian" %}
+ChallengeResponseAuthentication no
+UsePAM yes
+PrintMotd no
+UsePrivilegeSeparation sandbox
+Subsystem sftp /usr/lib/ssh/sftp-server
+{% endif %}
diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml
new file mode 100644
index 0000000..0a0e259
--- /dev/null
+++ b/roles/users/tasks/main.yml
@@ -0,0 +1,38 @@
+
+# users ~~ roles/users/tasks/main.yml
+# Manage default users
+
+---
+
+- name: retrieve available users
+  shell: awk -F ":" '{ if($3 == 0 || $3 > 999 && $3 < 16000) { print $1 }}' /etc/passwd
+  register: valid_users_shell
+
+- name: change shell to zsh for all valid users
+  user: name="{{ item }}" shell="{{ path_zsh }}"
+  loop: "{{ valid_users_shell.stdout_lines }}"
+
+- name: add operator user
+  user:
+    name: "{{ user_op }}"
+    comment: Operator user
+    group: "{{ group_root }}"
+
+- name: remove default users
+  user:
+    name: "{{ item }}"
+    state: absent
+    remove: true
+  loop:
+    - toor
+    - pi
+
+- name: generate doas configuration
+  template:
+    src: doas.conf.j2
+    dest: "{{ path_doasconfig }}"
+    owner: root
+    group: "{{ group_root }}"
+    mode: 0644
+  when: ansible_become_method == "doas"
+
diff --git a/roles/users/templates/doas.conf.j2 b/roles/users/templates/doas.conf.j2
new file mode 100644
index 0000000..51ee4cf
--- /dev/null
+++ b/roles/users/templates/doas.conf.j2
@@ -0,0 +1,6 @@
+
+# doas ~~ /etc/doas.conf
+# managed by Ansible
+
+permit keepenv nopass root
+permit keepenv nopass {{ user_op }} as root