noah.knegt/ansible-automations
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: Swap to ansible roles for config

Browse Source 
Signed-off-by: Noah Knegt <git@noahknegt.com>
This commit is contained in:
Noah Knegt
2023-02-27 16:39:00 +01:00
parent 470fedf579
commit bc7c984206
17 changed files with 286 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
playbooks/base.yml Normal file
View File

@@ -0,0 +1,14 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This will apply the base configuration to the list of machines.
#===================================================================================================
---
- hosts: all
remote_user: root
roles:
- base

63
playbooks/create-user.yml
View File

@@ -1,63 +0,0 @@
#===========================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 09-02-2023
# @description : This playbook will create a user on a remote hosts and
# adds an ssh key to the authorized_keys file. It will also
# disable password authentication and root login.
#===========================================================================
- hosts: ubuntu
vars:
provision_password: '$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/'
gather_facts: false
remote_user: root
tasks:
- name: Add new provisioning user
user:
name: provision
password: "{{ provision_password }}"
shell: /bin/bash
- name: Add provisioning user to sudoers
copy:
dest: /etc/sudoers.d/provision
content: "provision ALL=(ALL) NOPASSWD:ALL"
- name: Deploy SSH key
authorized_key:
user: provision
key: "{{ lookup('file', '/home/noahk/.ssh/id_ed25519.pub') }}"
state: present
- name: Disable password authentication
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^PasswordAuthentication'
line: 'PasswordAuthentication no'
state: present
backup: yes
validate: 'sshd -t -f %s'
notify:
- restart ssh
- name: Disable root login
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^PermitRootLogin'
line: 'PermitRootLogin no'
state: present
backup: yes
validate: 'sshd -t -f %s'
notify:
- restart ssh
handlers:
- name: restart ssh
service:
name: sshd
state: restarted

1
roles/base/files/ansible/ansible.pub Normal file
View File

@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2IpJL9ZvIjLPRAn70ElcSWDTIm3f2930U9TK/aPmX0 personal@noahknegt.com

1
roles/base/files/ansible/ansible_sudoers Normal file
View File

@@ -0,0 +1 @@
ansible ALL=(ALL) NOPASSWD:ALL

1
roles/base/files/noahk/noahk.pub Normal file
View File

@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2IpJL9ZvIjLPRAn70ElcSWDTIm3f2930U9TK/aPmX0 personal@noahknegt.com

1
roles/base/files/noahk/noahk_sudoers Normal file
View File

@@ -0,0 +1 @@
noahk ALL=(ALL) ALL:ALL

2
roles/base/files/ssh_banner.net Normal file
View File

@@ -0,0 +1,2 @@
Use of this system is private. If you are not authorized, disconnect immediately.
Failure to comply will result in your destruction.

18
roles/base/handlers/main.yml Normal file
View File

@@ -0,0 +1,18 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains all the handlers for the base role.
#===================================================================================================
---
- name: apt_update
apt:
update_cache: yes
- name: restart_sshd
service:
name: "{{ openssh_service }}"
state: restarted

24
roles/base/tasks/main.yml Normal file
View File

@@ -0,0 +1,24 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains the tasks for the base role, this role will be applied to
# all machines.
#===================================================================================================
---
- include_vars: "{{ ansible_distribution }}.yml"
- block:
# Setup the ansible user
- include_tasks: users/ansible.yml
- include_tasks: users/noahk.yml
# Setup the sshd
- include_tasks: system/openssh.yml
# Setup the repositories for Debian based systems
- include_tasks: software/repositories.yml

17
roles/base/tasks/software/repositories.yml Normal file
View File

@@ -0,0 +1,17 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This will contain all the default software for the machines.
#===================================================================================================
---
- name: Install aptitude and software-properties-common
package:
name:
- aptitude
- software-properties-common
state: latest
when: ansible_distribution in ["Debian", "Pop!_OS", "Ubuntu"]

40
roles/base/tasks/system/openssh.yml Normal file
View File

@@ -0,0 +1,40 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This will setup the ssh server on the machine.
#===================================================================================================
---
- name: Install or update openssh
apt:
name: "{{ openssh_package }}"
state: latest
notify:
- restart_sshd
- name: enable ssh daemon
service:
name: "{{ openssh_service }}"
state: started
enabled: yes
- name: configure sshd
template:
src: sshd_config.j2
dest: /etc/ssh/sshd_config
owner: root
group: root
mode: 0644
notify:
- restart_sshd
- name: copy sshd banner
copy:
src: ssh_banner.net
dest: /etc/issue.net
owner: root
group: root
mode: 0644

48
roles/base/tasks/users/ansible.yml Normal file
View File

@@ -0,0 +1,48 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : It contains the tasks to properly configure the ansible user.
#===================================================================================================
---
- name: Add ansible group
group:
name: ansible
state: present
- name: Add new ansible user
user:
name: ansible
group: ansible
groups: ansible,{{ sudo_group }}
password: "{{ ansible_password }}"
state: present
shell: /bin/bash
- name: Add ansible user to sudoers
copy:
src: files/ansible_sudoers
dest: /etc/sudoers.d/ansible
owner: root
group: root
mode: 0440
- name: Create .ssh directory
file:
path: /home/ansible/.ssh
state: directory
owner: ansible
group: ansible
mode: 0700
with_items:
- { dir: /home/ansible/.ssh }
- name: Copy ssh public key
authorized_key:
user: ansible
key: "{{ item }}"
with_file:
- ansible/ansible.pub

48
roles/base/tasks/users/noahk.yml Normal file
View File

@@ -0,0 +1,48 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This will setup the normal user on the machine.
#===================================================================================================
---
- name: Create the group
group:
name: noahk
state: present
- name: Create the user
user:
name: noahk
group: noahk
groups: noahk,{{ sudo_group }}
password: "{{ noahk_password }}"
state: present
shell: /bin/bash
- name: Add user to sudoers
copy:
src: files/noahk_sudoers
dest: /etc/sudoers.d/noahk
owner: root
group: root
mode: 0440
- name: Create .ssh directory
file:
path: /home/noahk/.ssh
state: directory
owner: noahk
group: noahk
mode: 0700
with_items:
- { dir: /home/noahk/.ssh }
- name: Copy ssh public key
authorized_key:
user: noahk
key: "{{ item }}"
with_file:
- noahk/noahk.pub

33
roles/base/templates/sshd_config.j2 Normal file
View File

@@ -0,0 +1,33 @@
Banner /etc/issue.net
PrintMOTD no
Port {{ ssh_port | default(22) }}
Protocol 2
# Authentication:
AllowUsers {{ ssh_users | default("noahk") }}
ChallengeResponseAuthentication no
HostbasedAuthentication no
LoginGraceTime 120
PasswordAuthentication {{ passwd_auth | default("no") }}
PermitEmptyPasswords no
PermitRootLogin no
PubkeyAuthentication yes
StrictModes yes
UsePAM yes
# Security
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
IgnoreRhosts yes
# Misc. options
AcceptEnv LANG LC_*
TCPKeepAlive yes
Subsystem sftp {{ sftp_path }}
# Logging
SyslogFacility AUTH
LogLevel INFO

13
roles/base/vars/debian.yml Normal file
View File

@@ -0,0 +1,13 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains all the variables for the base role, for the debian OS.
#===================================================================================================
---
sudo_group: sudo
openssh_service: ssh
openssh_package: openssh-server

12
roles/base/vars/main.yml Normal file
View File

@@ -0,0 +1,12 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains the variables for the base role tasks.
#===================================================================================================
---
ansible_password: '$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/'
noahk_password: '$6$8eLzx6DNI/aamHAp$ZJK3kpbXDaMDUxuCFzRbbYL78aqdDnRRd1zbQPO2ED.pQQdcuAEnwBI2Vf3a36j7I5ED4STx6TLQnB8RiY3Vw/'

13
roles/base/vars/ubuntu.yml Normal file
View File

@@ -0,0 +1,13 @@
#===================================================================================================
# ? ABOUT
# @author : Noah Knegt
# @email : personal@noahknegt.com
# @repo : https://git.noahknegt.com/noah.knegt/ansible-automations
# @createdOn : 27-02-2023
# @description : This file contains all the variables for the base role, for the ubuntu OS.
#===================================================================================================
---
sudo_group: sudo
openssh_service: ssh
openssh_package: openssh-server