71 lines
2.2 KiB
YAML
71 lines
2.2 KiB
YAML
# users-ssh-nopasswd.yml
|
|
- name: Ensure users, SSH keys, and passwordless sudo
|
|
hosts: all
|
|
become: true
|
|
become_user: root
|
|
become_method: sudo
|
|
|
|
vars:
|
|
users:
|
|
- name: automation
|
|
shell: /bin/bash
|
|
# optional extra groups besides sudo/wheel
|
|
groups: []
|
|
sudo_nopasswd: true
|
|
keys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEx+ltCKNIEM7F4PzGLv22cIu7N0Fpn5gxwV02xq0GS9 automation@im.cz"
|
|
|
|
- name: hellsos
|
|
shell: /bin/bash
|
|
groups: []
|
|
sudo_nopasswd: true
|
|
keys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhfQt1VNQo8EbIog4yjU5VEF3mTyMEC7o1Qe95X4JwG jan@rabcan.cz"
|
|
|
|
- name: jim
|
|
shell: /bin/bash
|
|
groups: []
|
|
sudo_nopasswd: true
|
|
keys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPFS4fsqMjMMu/Bi/884bw7yJBqvWusDRESvanH6Owco jakub@jimbuntu"
|
|
|
|
tasks:
|
|
- name: Pick sudo group per distro
|
|
ansible.builtin.set_fact:
|
|
sudo_group: "{{ 'wheel' if ansible_facts.os_family in ['RedHat','Rocky','AlmaLinux','Fedora','OracleLinux','Suse'] else 'sudo' }}"
|
|
|
|
- name: Ensure user exists (creates home)
|
|
ansible.builtin.user:
|
|
name: "{{ item.name }}"
|
|
shell: "{{ item.shell | default('/bin/bash') }}"
|
|
groups: >-
|
|
{{ (
|
|
(item.groups | default([]))
|
|
+ ([sudo_group] if item.sudo_nopasswd | default(false) else [])
|
|
) | unique | join(',') if
|
|
((item.groups | default([])) | length > 0) or (item.sudo_nopasswd | default(false))
|
|
else omit }}
|
|
append: true
|
|
create_home: true
|
|
state: present
|
|
loop: "{{ users }}"
|
|
|
|
- name: Install authorized SSH keys
|
|
ansible.builtin.authorized_key:
|
|
user: "{{ item.0.name }}"
|
|
key: "{{ item.1 }}"
|
|
state: present
|
|
manage_dir: true
|
|
loop: "{{ users | subelements('keys', skip_missing=True) }}"
|
|
|
|
- name: Grant passwordless sudo via sudoers.d
|
|
ansible.builtin.copy:
|
|
dest: "/etc/sudoers.d/{{ item.name }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
content: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL"
|
|
validate: 'visudo -cf %s'
|
|
when: item.sudo_nopasswd | default(false)
|
|
loop: "{{ users }}"
|