76 lines
2.3 KiB
YAML
76 lines
2.3 KiB
YAML
---
|
|
## Checks/deploys a Linux system to be managed with Ansible.
|
|
|
|
- hosts: all
|
|
gather_facts: yes
|
|
become: yes
|
|
|
|
tasks:
|
|
# User account (ansible) configuration
|
|
- name: Add deployment user.
|
|
user:
|
|
name: ansible
|
|
state: present
|
|
|
|
# Ansible user SSH pub key
|
|
- name: Add deployment user's SSH key.
|
|
ansible.posix.authorized_key:
|
|
user: ansible
|
|
state: present
|
|
key: "{{ ansiblesvc_key }}"
|
|
|
|
# Give ansible sudo rights with no password required.
|
|
- name: Add sudo rights with no password for deployment user.
|
|
lineinfile:
|
|
dest: /etc/sudoers
|
|
regexp: '^ansible'
|
|
line: 'ansible ALL=(ALL) NOPASSWD: ALL'
|
|
state: present
|
|
validate: 'visudo -cf %s'
|
|
|
|
# Configure firewalld (if installed) to be disabled (especially if an internal server.) Firewall rules are managed by UniFi.
|
|
- name: Stop and disable firewalld.
|
|
service:
|
|
name: firewalld
|
|
state: stopped
|
|
enabled: False
|
|
ignore_errors: True
|
|
|
|
# User account (nhadmin) configuration, for sysadmin use
|
|
- name: Create user nhadmin.
|
|
user:
|
|
name: nhadmin
|
|
state: present
|
|
password: "{{ nhadmin_password | password_hash('sha512') }}"
|
|
# add to sudo
|
|
groups: sudo
|
|
append: yes
|
|
|
|
# SSH config updating
|
|
- name: Update SSH configuration to be more secure.
|
|
lineinfile:
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
state: present
|
|
validate: 'sshd -t -f %s'
|
|
with_items:
|
|
- regexp: "^PermitRootLogin"
|
|
line: "PermitRootLogin no"
|
|
notify: restart ssh
|
|
|
|
# Delete our network ansible key from the root user.
|
|
- name: Delete our network ansible key from the root user.
|
|
ansible.builtin.file:
|
|
path: /root/.ssh/authorized_keys
|
|
state: absent
|
|
ignore_errors: yes
|
|
|
|
# New 04/28/24: Do not use the DHCP Client ID as our MAC Address.
|
|
- name: Configure dhclient to use the MAC address of the system instead of Client ID.
|
|
blockinfile:
|
|
state: present
|
|
insertafter: EOF
|
|
dest: /etc/dhclient/dhclient.conf
|
|
marker: "# Changed by ansible playbook: Use MAC address instead of DHCP Client ID"
|
|
content: |