noah.knegt/ansible-automations
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move base to setup role

Browse Source 
Signed-off-by: Noah Knegt <git@noahknegt.com>
This commit is contained in:
Noah Knegt
2023-03-27 16:32:09 +02:00
parent 7197ff9140
commit 6e457b2be3
17 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
roles/setup/files/ansible/ansible.pub Normal file
View File

@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2IpJL9ZvIjLPRAn70ElcSWDTIm3f2930U9TK/aPmX0 personal@noahknegt.com

1
roles/setup/files/ansible/ansible_sudoers Normal file
View File

@@ -0,0 +1 @@
ansible ALL=(ALL) NOPASSWD:ALL

1
roles/setup/files/noahk/noahk.pub Normal file
View File

@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2IpJL9ZvIjLPRAn70ElcSWDTIm3f2930U9TK/aPmX0 personal@noahknegt.com

1
roles/setup/files/noahk/noahk_sudoers Normal file
View File

@@ -0,0 +1 @@
noahk ALL=(ALL:ALL) ALL

2
roles/setup/files/ssh_banner.net Normal file
View File

@@ -0,0 +1,2 @@
Use of this system is private. If you are not authorized, disconnect immediately.
Failure to comply will result in your destruction.

18
roles/setup/handlers/main.yml Normal file
View File

@@ -0,0 +1,18 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains all the handlers for the base role.
#===================================================================================================
---
- name: apt_update
apt:
update_cache: yes
- name: restart_sshd
service:
name: "{{ openssh_service }}"
state: restarted

24
roles/setup/tasks/main.yml Normal file
View File

@@ -0,0 +1,24 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains the tasks for the base role, this role will be applied to
# all machines.
#===================================================================================================
---
- include_vars: "{{ ansible_distribution }}.yml"
- block:
# Setup the ansible user
- include_tasks: users/ansible.yml
- include_tasks: users/noahk.yml
# Setup the sshd
- include_tasks: system/openssh.yml
# Setup the repositories for Debian based systems
- include_tasks: software/repositories.yml

17
roles/setup/tasks/software/repositories.yml Normal file
View File

@@ -0,0 +1,17 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This will contain all the default software for the machines.
#===================================================================================================
---
- name: Install aptitude and software-properties-common
package:
name:
- aptitude
- software-properties-common
state: latest
when: ansible_distribution in ["Debian", "Pop!_OS", "Ubuntu"]

40
roles/setup/tasks/system/openssh.yml Normal file
View File

@@ -0,0 +1,40 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This will setup the ssh server on the machine.
#===================================================================================================
---
- name: Install or update openssh
package:
name: "{{ openssh_package }}"
state: latest
notify:
- restart_sshd
- name: enable ssh daemon
service:
name: "{{ openssh_service }}"
state: started
enabled: yes
- name: configure sshd
template:
src: sshd_config.j2
dest: /etc/ssh/sshd_config
owner: root
group: root
mode: 0644
notify:
- restart_sshd
- name: copy sshd banner
copy:
src: ssh_banner.net
dest: /etc/issue.net
owner: root
group: root
mode: 0644

48
roles/setup/tasks/users/ansible.yml Normal file
View File

@@ -0,0 +1,48 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : It contains the tasks to properly configure the ansible user.
#===================================================================================================
---
- name: Add ansible group
group:
name: ansible
state: present
- name: Add new ansible user
user:
name: ansible
group: ansible
groups: ansible,{{ sudo_group }}
password: "{{ ansible_password }}"
state: present
shell: /bin/bash
- name: Add ansible user to sudoers
copy:
src: ansible/ansible_sudoers
dest: /etc/sudoers.d/ansible
owner: root
group: root
mode: 0440
- name: Create .ssh directory
file:
path: /home/ansible/.ssh
state: directory
owner: ansible
group: ansible
mode: 0700
with_items:
- { dir: /home/ansible/.ssh }
- name: Copy ssh public key
authorized_key:
user: ansible
key: "{{ item }}"
with_file:
- ansible/ansible.pub

48
roles/setup/tasks/users/noahk.yml Normal file
View File

@@ -0,0 +1,48 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This will setup the normal user on the machine.
#===================================================================================================
---
- name: Create the group
group:
name: noahk
state: present
- name: Create the user
user:
name: noahk
group: noahk
groups: noahk,{{ sudo_group }}
password: "{{ noahk_password }}"
state: present
shell: /bin/bash
- name: Add user to sudoers
copy:
src: noahk/noahk_sudoers
dest: /etc/sudoers.d/noahk
owner: root
group: root
mode: 0440
- name: Create .ssh directory
file:
path: /home/noahk/.ssh
state: directory
owner: noahk
group: noahk
mode: 0700
with_items:
- { dir: /home/noahk/.ssh }
- name: Copy ssh public key
authorized_key:
user: noahk
key: "{{ item }}"
with_file:
- noahk/noahk.pub

33
roles/setup/templates/sshd_config.j2 Normal file
View File

@@ -0,0 +1,33 @@
Banner /etc/issue.net
PrintMOTD no
Port {{ ssh_port | default(22) }}
Protocol 2
# Authentication:
AllowUsers {{ ssh_users | default("noahk ansible") }}
ChallengeResponseAuthentication no
HostbasedAuthentication no
LoginGraceTime 120
PasswordAuthentication {{ passwd_auth | default("no") }}
PermitEmptyPasswords no
PermitRootLogin no
PubkeyAuthentication yes
StrictModes yes
UsePAM yes
# Security
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
IgnoreRhosts yes
# Misc. options
AcceptEnv LANG LC_*
TCPKeepAlive yes
Subsystem sftp {{ sftp_path }}
# Logging
SyslogFacility AUTH
LogLevel INFO

14
roles/setup/vars/Archlinux.yml Normal file
View File

@@ -0,0 +1,14 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains the variables for arch based distros.
#===================================================================================================
---
sudo_group: wheel
openssh_service: sshd
openssh_package: openssh
sftp_path: /usr/lib/ssh/sftp-server

14
roles/setup/vars/Debian.yml Normal file
View File

@@ -0,0 +1,14 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains all the variables for the base role, for the debian OS.
#===================================================================================================
---
sudo_group: sudo
openssh_service: ssh
openssh_package: openssh-server
sftp_path: /usr/lib/openssh/sftp-server

15
roles/setup/vars/Ubuntu.yml Normal file
View File

@@ -0,0 +1,15 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains all the variables for the base role, for the debian OS.
#===================================================================================================
---
sudo_group: sudo
openssh_service: ssh
openssh_package: openssh-server
sftp_path: /usr/lib/openssh/sftp-server
ssh_port: 4422

12
roles/setup/vars/main.yml Normal file
View File

@@ -0,0 +1,12 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains the variables for the base role tasks.
#===================================================================================================
---
ansible_password: '$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/'
noahk_password: '$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/'