From 75b32e60aad2bc2d8d1746be1dbc6d6bf422592e Mon Sep 17 00:00:00 2001 From: binary Date: Thu, 19 Nov 2020 14:13:28 +0100 Subject: Move roles functionnality in sub-roles --- roles/common/tasks/main.yml | 15 +++++++------- roles/common/templates/motd.j2 | 13 ++++++++++++ roles/git/tasks/main.yml | 20 +++++++++++++++++++ roles/ssh_dns/tasks/main.yml | 8 ++++++++ roles/sshd/tasks/main.yml | 24 +++++++++++++++++++++++ roles/sshd/templates/generate_dns.j2 | 24 +++++++++++++++++++++++ roles/sshd/templates/sshd_config.j2 | 25 ++++++++++++++++++++++++ roles/users/tasks/main.yml | 38 ++++++++++++++++++++++++++++++++++++ roles/users/templates/doas.conf.j2 | 6 ++++++ 9 files changed, 166 insertions(+), 7 deletions(-) create mode 100644 roles/common/templates/motd.j2 create mode 100644 roles/git/tasks/main.yml create mode 100644 roles/ssh_dns/tasks/main.yml create mode 100644 roles/sshd/tasks/main.yml create mode 100644 roles/sshd/templates/generate_dns.j2 create mode 100644 roles/sshd/templates/sshd_config.j2 create mode 100644 roles/users/tasks/main.yml create mode 100644 roles/users/templates/doas.conf.j2 diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 6e816c7..5dca08d 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -27,13 +27,14 @@ group: "{{ group_root }}" mode: 0644 +- name: copy motd configuration file + template: + src: motd.j2 + dest: /etc/motd + owner: root + group: "{{ group_root }}" + mode: 0644 + - name: synchronize host hostname with config hostname hostname: name="{{ inventory_hostname }}" -- name: retrieve all users - shell: awk -F ":" '{ if($3 == 0 || $3 > 999 && $3 < 16000) { print $1 }}' /etc/passwd - register: valid_users_shell - -- name: change shell to zsh for all valid users - user: name="{{ item }}" shell="{{ path_zsh }}" - loop: "{{ valid_users_shell.stdout_lines }}" diff --git a/roles/common/templates/motd.j2 b/roles/common/templates/motd.j2 new file mode 100644 index 0000000..8090ab0 --- /dev/null +++ b/roles/common/templates/motd.j2 @@ -0,0 +1,13 @@ +{% set sep = "▍" %} + + {{ sep }} rgoncalves.se network + {{ sep }} + {{ sep }} support : support@rgoncalves.se + {{ sep }} look for changes : git.rgoncalves.se + + {{ sep }} system + {{ sep }} + {{ sep }} hostname : {{ ansible_hostname }} + {{ sep }} distribution : {{ ansible_distribution }} {{ ansible_distribution_version }} + {{ sep }} kernel revision : {{ ansible_kernel }} {{ ansible_kernel_version }} + diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml new file mode 100644 index 0000000..74481e4 --- /dev/null +++ b/roles/git/tasks/main.yml @@ -0,0 +1,20 @@ + +# git ~~ roles/git/tasks/main.yml +# Init git user and settings + +--- + +- name: create git-only directory + file: + path: /data/git + owner: git + group: git + state: directory + mode: 0741 + +- name: create git user + user: + name: git + group: git + shell: "{{ path_gitshell }}" + diff --git a/roles/ssh_dns/tasks/main.yml b/roles/ssh_dns/tasks/main.yml new file mode 100644 index 0000000..60a21bd --- /dev/null +++ b/roles/ssh_dns/tasks/main.yml @@ -0,0 +1,8 @@ + +# ssh ~~ tasks/local_dns.yml + +- name: Generate template to localhost + template: + src: templates/generate_dns.j2 + dest: "{{ lookup('env', 'HOME') }}/.ssh/config.d/ssh_dns" + delegate_to: 127.0.0.1 diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml new file mode 100644 index 0000000..0969429 --- /dev/null +++ b/roles/sshd/tasks/main.yml @@ -0,0 +1,24 @@ + +# sshd ~~ roles/sshd/tasks/main.yml +# Create sshd configuration and restart daemon + +--- + +- name: generate sshd configuration + template: + src: templates/sshd_config.j2 + dest: /etc/ssh/sshd_config + owner: "{{ user_root }}" + group: "{{ group_root }}" + mode: 0644 + +- name: restart sshd + service: + name: sshd + state: restarted + +- name: check ssh connection + wait_for: + port: 22 + delay: 1 + state: started diff --git a/roles/sshd/templates/generate_dns.j2 b/roles/sshd/templates/generate_dns.j2 new file mode 100644 index 0000000..5d58ae9 --- /dev/null +++ b/roles/sshd/templates/generate_dns.j2 @@ -0,0 +1,24 @@ + +# ssh configuration for dns ~~ ~/.ssh/.config.d/ +# managed by Ansible + +{% for h in groups["all"] %} +{% set h = hostvars[h] %} +{##} +{% if h.ip is defined and h.services is defined %} +{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %} +{##} +# {{ h.ansible_host }} + +Match originalhost {{ h.ansible_host }} exec "ls /sys/class/net/{{ _i.dcontroller }} && ! ping -c 1 -W 5 {{ h.ip.out }}" + HostName {{ h.ip.in }} + Port {{ _port }} + +Match originalhost {{ h.ansible_host }} + HostName {{ h.ip.out }} + Port {{ _port }} + User root + +{% endif %} +{##} +{% endfor %} diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2 new file mode 100644 index 0000000..a11268e --- /dev/null +++ b/roles/sshd/templates/sshd_config.j2 @@ -0,0 +1,25 @@ + +# ssh ~~ /etc/ssh/sshd_config +# managed by Ansible + +# security +PermitRootLogin yes +MaxAuthTries 6 +MaxSessions 10 + +# auth +AuthorizedKeysFile .ssh/authorized_keys +PasswordAuthentication no +PermitEmptyPasswords no +ClientAliveInterval 180 + + +{% if ansible_facts["os_family"] == "OpenBSD" or ansible_facts["os_family"] == "Alpine" %} +Subsystem sftp /usr/libexec/sftp-server +{% elif ansible_facts["os_family"] == "Debian" %} +ChallengeResponseAuthentication no +UsePAM yes +PrintMotd no +UsePrivilegeSeparation sandbox +Subsystem sftp /usr/lib/ssh/sftp-server +{% endif %} diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml new file mode 100644 index 0000000..0a0e259 --- /dev/null +++ b/roles/users/tasks/main.yml @@ -0,0 +1,38 @@ + +# users ~~ roles/users/tasks/main.yml +# Manage default users + +--- + +- name: retrieve available users + shell: awk -F ":" '{ if($3 == 0 || $3 > 999 && $3 < 16000) { print $1 }}' /etc/passwd + register: valid_users_shell + +- name: change shell to zsh for all valid users + user: name="{{ item }}" shell="{{ path_zsh }}" + loop: "{{ valid_users_shell.stdout_lines }}" + +- name: add operator user + user: + name: "{{ user_op }}" + comment: Operator user + group: "{{ group_root }}" + +- name: remove default users + user: + name: "{{ item }}" + state: absent + remove: true + loop: + - toor + - pi + +- name: generate doas configuration + template: + src: doas.conf.j2 + dest: "{{ path_doasconfig }}" + owner: root + group: "{{ group_root }}" + mode: 0644 + when: ansible_become_method == "doas" + diff --git a/roles/users/templates/doas.conf.j2 b/roles/users/templates/doas.conf.j2 new file mode 100644 index 0000000..51ee4cf --- /dev/null +++ b/roles/users/templates/doas.conf.j2 @@ -0,0 +1,6 @@ + +# doas ~~ /etc/doas.conf +# managed by Ansible + +permit keepenv nopass root +permit keepenv nopass {{ user_op }} as root -- cgit v1.2.3