From 5d07c5c3ea19bf03232ab6c90c3176f1ab0388f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Romain=20Gon=C3=A7alves?= Date: Mon, 3 May 2021 20:21:31 +0200 Subject: sshdns: Refactor role for _workstation only --- roles/_workstation/env/tasks/main.yml | 12 +++++++++-- roles/_workstation/sshdns/defaults/main.yml | 3 +++ roles/_workstation/sshdns/tasks/main.yml | 17 +++++++++++++++ roles/_workstation/sshdns/templates/sshdns.j2 | 20 ++++++++++++++++++ roles/_workstation/sysconf/tasks/_void.yml | 2 +- roles/_workstation/sysconf/tasks/main.yml | 8 +++---- roles/sshdns/tasks/main.yml | 30 --------------------------- roles/sshdns/templates/generate_dns.j2 | 25 ---------------------- 8 files changed, 55 insertions(+), 62 deletions(-) create mode 100644 roles/_workstation/sshdns/defaults/main.yml create mode 100644 roles/_workstation/sshdns/tasks/main.yml create mode 100644 roles/_workstation/sshdns/templates/sshdns.j2 delete mode 100644 roles/sshdns/tasks/main.yml delete mode 100644 roles/sshdns/templates/generate_dns.j2 (limited to 'roles') diff --git a/roles/_workstation/env/tasks/main.yml b/roles/_workstation/env/tasks/main.yml index 3c54210..261170e 100644 --- a/roles/_workstation/env/tasks/main.yml +++ b/roles/_workstation/env/tasks/main.yml @@ -8,9 +8,17 @@ stat: path=/usr/bin/doas register: _workstation_env_become +- name: retrieve existing users + shell: cat /etc/passwd | cut -d ":" -f 1 + register: result + +- name: check if target user exists + fail: + msg: _ws_user is not a valid user + when: _ws_user not in result.stdout_lines + - name: retrieve host facts set_fact: #ansible_become_method: "{{ 'doas' if _workstation_env_become.stat.exists else 'sudo' }}" ansible_become_method: "su" - ansible_become_user: "{{ _workstation_env_user }}" - + ansible_become_user: "{{ _ws_user }}" diff --git a/roles/_workstation/sshdns/defaults/main.yml b/roles/_workstation/sshdns/defaults/main.yml new file mode 100644 index 0000000..9427f1d --- /dev/null +++ b/roles/_workstation/sshdns/defaults/main.yml @@ -0,0 +1,3 @@ +--- + +sshdns_waittime: 2 diff --git a/roles/_workstation/sshdns/tasks/main.yml b/roles/_workstation/sshdns/tasks/main.yml new file mode 100644 index 0000000..daf8f61 --- /dev/null +++ b/roles/_workstation/sshdns/tasks/main.yml @@ -0,0 +1,17 @@ +--- + +- name: create config directory + file: + path: '/home/{{ _ws_user }}/.ssh/config.d' + state: directory + group: '{{ _ws_user }}' + owner: '{{ _ws_user }}' + mode: '0700' + +- name: generate template to localhost + template: + src: templates/sshdns.j2 + dest: '/home/{{ _ws_user }}//.ssh/config.d/ssh_dns' + owner: '{{ _ws_user }}' + group: '{{ _ws_user }}' + mode: '0600' diff --git a/roles/_workstation/sshdns/templates/sshdns.j2 b/roles/_workstation/sshdns/templates/sshdns.j2 new file mode 100644 index 0000000..1778215 --- /dev/null +++ b/roles/_workstation/sshdns/templates/sshdns.j2 @@ -0,0 +1,20 @@ +{% import 'macros.j2' as macros with context %} + +# ssh configuration for dns ~~ ~/.ssh/.config.d/ +# managed by Ansible + +{% set dcontroller = hostvars[global.dcontroller] %} +{% call(h) macros.loop_hosts("servers") %} +{% if h.ip is defined and h.services is defined %} +{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %} +# {{ h.ansible_host }} +Match originalhost {{ h.ansible_host }} exec "ping -c 1 -w {{ sshdns_waittime }} {{ dcontroller.ip.in }} && ! ping -c 1 -w {{ sshdns_waittime }} {{ h.ip.out }}" + HostName {{ h.ip.in }} + Port {{ _port }} +Match originalhost {{ h.ansible_host }} + HostName {{ h.ip.out }} + Port {{ _port }} + User root + +{% endif %} +{% endcall %} diff --git a/roles/_workstation/sysconf/tasks/_void.yml b/roles/_workstation/sysconf/tasks/_void.yml index e05e2ef..1337cfa 100644 --- a/roles/_workstation/sysconf/tasks/_void.yml +++ b/roles/_workstation/sysconf/tasks/_void.yml @@ -12,7 +12,7 @@ - name: append current user to system groups user: - name: "{{ _workstation_env_user }}" + name: "{{ _ws_user }}" groups: "{{ item }}" append: true loop: diff --git a/roles/_workstation/sysconf/tasks/main.yml b/roles/_workstation/sysconf/tasks/main.yml index 253cacd..e3f14aa 100644 --- a/roles/_workstation/sysconf/tasks/main.yml +++ b/roles/_workstation/sysconf/tasks/main.yml @@ -11,8 +11,8 @@ - name: generate doas configuration lineinfile: path: /etc/doas.conf - regexp: "^permit persist keepenv {{ _workstation_env_user }} as root" - line: "permit persist keepenv {{ _workstation_env_user }} as root" + regexp: "^permit persist keepenv {{ _ws_user }} as root" + line: "permit persist keepenv {{ _ws_user }} as root" owner: root mode: 0644 create: true @@ -20,8 +20,8 @@ - name: allow reboot/shutdown/hibernate with doas lineinfile: path: /etc/doas.conf - regexp: "^permit nopass {{ _workstation_env_user }} as root cmd {{ item }}" - line: "permit nopass {{ _workstation_env_user }} as root cmd {{ item }}" + regexp: "^permit nopass {{ _ws_user }} as root cmd {{ item }}" + line: "permit nopass {{ _ws_user }} as root cmd {{ item }}" loop: - zzz - ZZZ diff --git a/roles/sshdns/tasks/main.yml b/roles/sshdns/tasks/main.yml deleted file mode 100644 index 30cc958..0000000 --- a/roles/sshdns/tasks/main.yml +++ /dev/null @@ -1,30 +0,0 @@ - -# ssh dns ~~ roles/ssh_dns/tasks/main.yml -# generate dns for ssh use on workstations - ---- - -- name: get real user - shell: logname - register: sshdns_user - delegate_to: localhost - -- name: parse real username - set_fact: - sshdns_user: "{{ sshdns_user.stdout }}" - -- name: create config directory - file: - #path: "{{ lookup('env', 'HOME') }}/.ssh/config.d" - path: "/home/{{ sshdns_user }}/.ssh/config.d" - state: directory - mode: 0700 - become: true - become_user: "{{ sshdns_user }}" - -- name: Generate template to localhost - template: - src: templates/generate_dns.j2 - dest: "/home/{{ sshdns_user }}//.ssh/config.d/ssh_dns" - become: true - become_user: "{{ sshdns_user }}" diff --git a/roles/sshdns/templates/generate_dns.j2 b/roles/sshdns/templates/generate_dns.j2 deleted file mode 100644 index 866e9aa..0000000 --- a/roles/sshdns/templates/generate_dns.j2 +++ /dev/null @@ -1,25 +0,0 @@ - -# ssh configuration for dns ~~ ~/.ssh/.config.d/ -# managed by Ansible - -{% for h in groups["all"] %} -{% set h = hostvars[h] %} -{% set dcontroller = hostvars[global.dcontroller] %} -{##} -{% if h.ip is defined and h.services is defined %} -{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %} -{##} -# {{ h.ansible_host }} - -Match originalhost {{ h.ansible_host }} exec "ping -c 1 -w 5 {{ dcontroller.ip.in }} && ! ping -c 1 -w 5 {{ h.ip.out }}" - HostName {{ h.ip.in }} - Port {{ _port }} - -Match originalhost {{ h.ansible_host }} - HostName {{ h.ip.out }} - Port {{ _port }} - User root - -{% endif %} -{##} -{% endfor %} -- cgit v1.2.3