From 5d07c5c3ea19bf03232ab6c90c3176f1ab0388f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Romain=20Gon=C3=A7alves?= <me@rgoncalves.se>
Date: Mon, 3 May 2021 20:21:31 +0200
Subject: sshdns: Refactor role for _workstation only

---
 playbooks/workstation.yml                     | 19 +++++++----------
 roles/_workstation/env/tasks/main.yml         | 12 +++++++++--
 roles/_workstation/sshdns/defaults/main.yml   |  3 +++
 roles/_workstation/sshdns/tasks/main.yml      | 17 +++++++++++++++
 roles/_workstation/sshdns/templates/sshdns.j2 | 20 ++++++++++++++++++
 roles/_workstation/sysconf/tasks/_void.yml    |  2 +-
 roles/_workstation/sysconf/tasks/main.yml     |  8 +++----
 roles/sshdns/tasks/main.yml                   | 30 ---------------------------
 roles/sshdns/templates/generate_dns.j2        | 25 ----------------------
 9 files changed, 62 insertions(+), 74 deletions(-)
 create mode 100644 roles/_workstation/sshdns/defaults/main.yml
 create mode 100644 roles/_workstation/sshdns/tasks/main.yml
 create mode 100644 roles/_workstation/sshdns/templates/sshdns.j2
 delete mode 100644 roles/sshdns/tasks/main.yml
 delete mode 100644 roles/sshdns/templates/generate_dns.j2

diff --git a/playbooks/workstation.yml b/playbooks/workstation.yml
index 6363a71..2a3534e 100644
--- a/playbooks/workstation.yml
+++ b/playbooks/workstation.yml
@@ -5,28 +5,23 @@
 ---
 
 - hosts: localhost
-  tasks:
-    - debug:
-        msg: RUN AS ROOT
+  pre_tasks:
+    - fail:
+        msg: must be run as root!
+      when: lookup('env', 'USER') != "root"
 
   roles:
-
-    - role: sshdns
-      tags: sshdns
-
     - role: _workstation/env
       tags: env, always
 
+    - role: _workstation/sshdns
+      tags: sshdns
+
     - role: _workstation/packages
       tags: packages
 
     - role: _workstation/sysconf
       tags: sysconf
 
-    #- role: _workstation/weechat-matrix
-      #tags: role_workstation_weechat
-      #become: true
-      #become_method: su
-
     - role: update
       tags: update
diff --git a/roles/_workstation/env/tasks/main.yml b/roles/_workstation/env/tasks/main.yml
index 3c54210..261170e 100644
--- a/roles/_workstation/env/tasks/main.yml
+++ b/roles/_workstation/env/tasks/main.yml
@@ -8,9 +8,17 @@
   stat: path=/usr/bin/doas 
   register: _workstation_env_become
 
+- name: retrieve existing users
+  shell: cat /etc/passwd | cut -d ":" -f 1
+  register: result
+
+- name: check if target user exists
+  fail:
+    msg: _ws_user is not a valid user
+  when: _ws_user not in result.stdout_lines
+
 - name: retrieve host facts
   set_fact:
     #ansible_become_method: "{{ 'doas' if _workstation_env_become.stat.exists else 'sudo' }}"
     ansible_become_method: "su"
-    ansible_become_user: "{{ _workstation_env_user }}"
-
+    ansible_become_user: "{{ _ws_user }}"
diff --git a/roles/_workstation/sshdns/defaults/main.yml b/roles/_workstation/sshdns/defaults/main.yml
new file mode 100644
index 0000000..9427f1d
--- /dev/null
+++ b/roles/_workstation/sshdns/defaults/main.yml
@@ -0,0 +1,3 @@
+---
+
+sshdns_waittime: 2
diff --git a/roles/_workstation/sshdns/tasks/main.yml b/roles/_workstation/sshdns/tasks/main.yml
new file mode 100644
index 0000000..daf8f61
--- /dev/null
+++ b/roles/_workstation/sshdns/tasks/main.yml
@@ -0,0 +1,17 @@
+---
+
+- name: create config directory
+  file:
+    path: '/home/{{ _ws_user }}/.ssh/config.d'
+    state: directory
+    group: '{{ _ws_user }}'
+    owner: '{{ _ws_user }}'
+    mode: '0700'
+
+- name: generate template to localhost
+  template:
+    src: templates/sshdns.j2
+    dest: '/home/{{ _ws_user }}//.ssh/config.d/ssh_dns'
+    owner: '{{ _ws_user }}'
+    group: '{{ _ws_user }}'
+    mode: '0600'
diff --git a/roles/_workstation/sshdns/templates/sshdns.j2 b/roles/_workstation/sshdns/templates/sshdns.j2
new file mode 100644
index 0000000..1778215
--- /dev/null
+++ b/roles/_workstation/sshdns/templates/sshdns.j2
@@ -0,0 +1,20 @@
+{% import 'macros.j2' as macros with context %}
+
+# ssh configuration for dns ~~ ~/.ssh/.config.d/
+# managed by Ansible
+
+{% set dcontroller = hostvars[global.dcontroller] %}
+{% call(h) macros.loop_hosts("servers") %}
+{% if h.ip is defined and h.services is defined %}
+{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %}
+# {{ h.ansible_host }}
+Match originalhost {{ h.ansible_host }} exec "ping -c 1 -w {{ sshdns_waittime }} {{ dcontroller.ip.in }} && ! ping -c 1 -w {{ sshdns_waittime }} {{ h.ip.out }}"
+	HostName {{ h.ip.in }}
+	Port {{ _port }}
+Match originalhost {{ h.ansible_host }}
+	HostName {{ h.ip.out }}
+	Port {{ _port }}
+	User root
+
+{% endif %}
+{% endcall %}
diff --git a/roles/_workstation/sysconf/tasks/_void.yml b/roles/_workstation/sysconf/tasks/_void.yml
index e05e2ef..1337cfa 100644
--- a/roles/_workstation/sysconf/tasks/_void.yml
+++ b/roles/_workstation/sysconf/tasks/_void.yml
@@ -12,7 +12,7 @@
 
 - name: append current user to system groups
   user:
-    name: "{{ _workstation_env_user }}"
+    name: "{{ _ws_user }}"
     groups: "{{ item }}"
     append: true
   loop:
diff --git a/roles/_workstation/sysconf/tasks/main.yml b/roles/_workstation/sysconf/tasks/main.yml
index 253cacd..e3f14aa 100644
--- a/roles/_workstation/sysconf/tasks/main.yml
+++ b/roles/_workstation/sysconf/tasks/main.yml
@@ -11,8 +11,8 @@
 - name: generate doas configuration
   lineinfile:
     path: /etc/doas.conf
-    regexp: "^permit persist keepenv {{ _workstation_env_user }} as root"
-    line: "permit persist keepenv {{ _workstation_env_user }} as root"
+    regexp: "^permit persist keepenv {{ _ws_user }} as root"
+    line: "permit persist keepenv {{ _ws_user }} as root"
     owner: root
     mode: 0644
     create: true
@@ -20,8 +20,8 @@
 - name: allow reboot/shutdown/hibernate with doas
   lineinfile:
     path: /etc/doas.conf
-    regexp: "^permit nopass {{ _workstation_env_user }} as root cmd {{ item }}"
-    line: "permit nopass {{ _workstation_env_user }} as root cmd {{ item }}"
+    regexp: "^permit nopass {{ _ws_user }} as root cmd {{ item }}"
+    line: "permit nopass {{ _ws_user }} as root cmd {{ item }}"
   loop:
     - zzz
     - ZZZ
diff --git a/roles/sshdns/tasks/main.yml b/roles/sshdns/tasks/main.yml
deleted file mode 100644
index 30cc958..0000000
--- a/roles/sshdns/tasks/main.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-
-# ssh dns ~~ roles/ssh_dns/tasks/main.yml
-# generate dns for ssh use on workstations
-
----
-
-- name: get real user
-  shell: logname
-  register: sshdns_user
-  delegate_to: localhost
-
-- name: parse real username
-  set_fact:
-    sshdns_user: "{{ sshdns_user.stdout }}"
-
-- name: create config directory
-  file:
-    #path: "{{ lookup('env', 'HOME') }}/.ssh/config.d"
-    path: "/home/{{ sshdns_user }}/.ssh/config.d"
-    state: directory
-    mode: 0700
-  become: true
-  become_user: "{{ sshdns_user }}"
-
-- name: Generate template to localhost
-  template:
-    src: templates/generate_dns.j2
-    dest: "/home/{{ sshdns_user }}//.ssh/config.d/ssh_dns"
-  become: true
-  become_user: "{{ sshdns_user }}"
diff --git a/roles/sshdns/templates/generate_dns.j2 b/roles/sshdns/templates/generate_dns.j2
deleted file mode 100644
index 866e9aa..0000000
--- a/roles/sshdns/templates/generate_dns.j2
+++ /dev/null
@@ -1,25 +0,0 @@
-
-# ssh configuration for dns ~~ ~/.ssh/.config.d/
-# managed by Ansible
-
-{% for h in groups["all"] %}
-{% set h = hostvars[h] %}
-{% set dcontroller = hostvars[global.dcontroller] %}
-{##}
-{% if h.ip is defined and h.services is defined %}
-{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %}
-{##}
-# {{ h.ansible_host }}
-
-Match originalhost {{ h.ansible_host }} exec "ping -c 1 -w 5 {{ dcontroller.ip.in }} && ! ping -c 1 -w 5 {{ h.ip.out }}"
-	HostName {{ h.ip.in }}
-	Port {{ _port }}
-
-Match originalhost {{ h.ansible_host }}
-	HostName {{ h.ip.out  }}
-	Port {{ _port }}
-	User root
-
-{% endif %}
-{##}
-{% endfor %}
-- 
cgit v1.2.3