technolog/ansible
1
0
Fork 0
Code Issues Pull Requests Activity

Trying to understand this ugh

Browse Source
This commit is contained in:
iRaven
2025-11-30 17:41:44 -06:00
parent 4fa0182002
commit 5722a24627
2 changed files with 118 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
linux/compliance.yaml
View File

@@ -2,6 +2,16 @@
## Checks/deploys a Linux system to be managed with Ansible. ## Checks/deploys a Linux system to be managed with Ansible.
- hosts: all - hosts: all
gather_facts: yes
tasks: tasks:
- name: "Set become method to doas (Alpine)"
vars:
ansible_become_method: doas
when: "ansible_distribution == 'Alpine'"
- name: "Set become to true"
vars:
ansible_become: true
- name: "Include OS specific tasks" - name: "Include OS specific tasks"
ansible.builtin.include_tasks: "compliance_{{ ansible_distribution }}.yaml" ansible.builtin.include_tasks: "compliance_{{ ansible_distribution }}.yaml"

15
linux/compliance_Alpine.yaml
View File

@@ -1,23 +1,16 @@
--- ---
## Checks/deploys a Linux system to be managed with Ansible. ## Checks/deploys a Linux system to be managed with Ansible.
gather_facts: yes
become: yes
become_method: doas
tasks:
# Gather system groups
- name: Gather all system groups - name: Gather all system groups
ansible.builtin.getent: ansible.builtin.getent:
database: group database: group
split: ':' split: ':'
# Add doas package # Add doas package
- name: Install doas (for Alpine systems). - name: Install doas (for Alpine systems).
ansible.builtin.package: ansible.builtin.package:
name: name:
- doas - doas
state: present state: present
# User account (ansible) configuration # User account (ansible) configuration
- name: Add deployment user. - name: Add deployment user.
user: user:
@@ -29,7 +22,6 @@ tasks:
groups: wheel groups: wheel
append: yes append: yes
when: "'wheel' in ansible_facts.getent_group" when: "'wheel' in ansible_facts.getent_group"
# Ansible user SSH pub key # Ansible user SSH pub key
# This is a really stupid way to do it, but alas. # This is a really stupid way to do it, but alas.
# This uses an environment variable named ansiblesvc_key in Semaphore which has the ssh-rsa pubkey. # This uses an environment variable named ansiblesvc_key in Semaphore which has the ssh-rsa pubkey.
@@ -45,7 +37,6 @@ tasks:
dest: /home/ansible/.ssh/authorized_keys dest: /home/ansible/.ssh/authorized_keys
owner: ansible owner: ansible
group: ansible group: ansible
# Add required packages because Debian is lame # Add required packages because Debian is lame
- name: Install standard packages if not already installed. - name: Install standard packages if not already installed.
# Looking at you LXCs. >.> # Looking at you LXCs. >.>
@@ -58,7 +49,6 @@ tasks:
- python3 - python3
- iftop - iftop
state: present state: present
# Give ansible doas rights with no password required. # Give ansible doas rights with no password required.
- name: Add doas rights with no password for deployment user (Alpine only) - name: Add doas rights with no password for deployment user (Alpine only)
lineinfile: lineinfile:
@@ -67,7 +57,6 @@ tasks:
line: 'permit keepenv nopass :ansible' line: 'permit keepenv nopass :ansible'
state: present state: present
validate: 'doas -C %s' validate: 'doas -C %s'
# User account (nhadmin) configuration, for sysadmin use # User account (nhadmin) configuration, for sysadmin use
- name: Create user nhadmin. - name: Create user nhadmin.
user: user:
@@ -75,14 +64,12 @@ tasks:
state: present state: present
password: "{{ nhadmin_password | password_hash('sha512') }}" password: "{{ nhadmin_password | password_hash('sha512') }}"
shell: /bin/bash shell: /bin/bash
- name: Add nhadmin to wheel group. - name: Add nhadmin to wheel group.
user: user:
name: nhadmin name: nhadmin
groups: wheel groups: wheel
append: yes append: yes
when: "'wheel' in ansible_facts.getent_group" when: "'wheel' in ansible_facts.getent_group"
# Sysadmin user SSH pub key # Sysadmin user SSH pub key
# This is a really stupid way to do it, but alas. # This is a really stupid way to do it, but alas.
# This uses an environment variable named nhadmin_key in Semaphore which has the ssh-rsa pubkey. # This uses an environment variable named nhadmin_key in Semaphore which has the ssh-rsa pubkey.
@@ -98,7 +85,6 @@ tasks:
dest: /home/nhadmin/.ssh/authorized_keys dest: /home/nhadmin/.ssh/authorized_keys
owner: nhadmin owner: nhadmin
group: nhadmin group: nhadmin
# SSH config updating # SSH config updating
- name: Update SSH configuration to disallow root login and disable password authentication. - name: Update SSH configuration to disallow root login and disable password authentication.
lineinfile: lineinfile:
@@ -118,7 +104,6 @@ tasks:
service: service:
name: sshd name: sshd
state: restarted state: restarted
# Delete our network ansible key from the root user. # Delete our network ansible key from the root user.
- name: Delete our network ansible key (and other keys) from the root user. - name: Delete our network ansible key (and other keys) from the root user.
file: file: