143 lines
3.9 KiB
YAML
143 lines
3.9 KiB
YAML
---
|
|
# tasks file for users
|
|
- name: manage users {{ user.name }}
|
|
user:
|
|
name: "{{ user.name }}"
|
|
state: "{{ user.state | default('present') }}"
|
|
comment: "{{ user.comment | default(omit) }}"
|
|
password: "{{ user.password | default(omit) }}"
|
|
uid: "{{ user.uid | default(omit) }}"
|
|
group: "{{ user.group | default(omit) }}"
|
|
groups: "{{ user.groups | default(omit) }}"
|
|
shell: "{{ user.shell | default(users_shell) }}"
|
|
update_password: "{{ user.update_password | default(omit) }}"
|
|
register: users_manage_user
|
|
|
|
- name: set sudo options for {{ user.name }}
|
|
template:
|
|
src: sudo.j2
|
|
dest: "/etc/sudoers.d/{{ user.name }}"
|
|
when:
|
|
- user.sudo_options is defined
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
|
|
- name: remove sudo options for {{ user.name }}
|
|
file:
|
|
path: "/etc/sudoers.d/{{ user.name }}"
|
|
state: absent
|
|
when:
|
|
- user.sudo_options is not defined
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
|
|
- name: generate private ssh key for {{ user.name }}
|
|
command: "{{ users_ssh_keygen_command }}"
|
|
args:
|
|
creates: "{{ users_ssh_key_directory }}/{{ user.name }}"
|
|
when:
|
|
- user.manage_ssh_key is defined
|
|
- user.manage_ssh_key | bool
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
delegate_to: localhost
|
|
become: no
|
|
|
|
- name: generate public ssh key for {{ user.name }}
|
|
shell: "{{ users_ssh_keygen_pubkey_command }} > {{ users_ssh_key_directory }}/{{ user.name }}.pub"
|
|
args:
|
|
creates: "{{ users_ssh_key_directory }}/{{ user.name }}.pub"
|
|
when:
|
|
- user.manage_ssh_key is defined
|
|
- user.manage_ssh_key | bool
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
delegate_to: localhost
|
|
become: no
|
|
|
|
- name: read generated public ssh key for {{ user.name }}
|
|
command: cat "{{ users_ssh_key_directory }}/{{ user.name }}.pub"
|
|
when:
|
|
- user.manage_ssh_key is defined
|
|
- user.manage_ssh_key | bool
|
|
changed_when: no
|
|
register: ssh_public_key
|
|
delegate_to: localhost
|
|
become: no
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
|
|
- name: convert ssh key to ppk for {{ user.name }}
|
|
shell: >
|
|
ssh-keygen -e -f "{{ users_ssh_key_directory }}/{{ user.name }}"
|
|
-C "Generated by Ansible role robertdebock.users"
|
|
> "{{ users_ssh_key_directory }}/{{ user.name }}.ppk"
|
|
args:
|
|
creates: "{{ users_ssh_key_directory }}/{{ user.name }}.ppk"
|
|
when:
|
|
- user.manage_ssh_key is defined
|
|
- user.manage_ssh_key | bool
|
|
delegate_to: localhost
|
|
become: no
|
|
|
|
- name: create .ssh directory for {{ user.name }}
|
|
file:
|
|
path: "{{ user.home }}/.ssh"
|
|
state: directory
|
|
mode: "0700"
|
|
become: yes
|
|
become_user: "{{ user.name }}"
|
|
when:
|
|
- users_manage_user is defined
|
|
- user.home is defined
|
|
|
|
- name: loop over authorized_key for {{ user.name }}
|
|
include: user_authorized_key.yml
|
|
with_items:
|
|
- "{{ user.authorized_key }}"
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
loop_var: authorized_key
|
|
when:
|
|
- user.authorized_key is defined
|
|
|
|
- name: loop over authorized_keys for {{ user.name }}
|
|
include: user_authorized_key.yml
|
|
with_items:
|
|
- "{{ user.authorized_keys }}"
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
loop_var: authorized_key
|
|
when:
|
|
- user.authorized_keys is defined
|
|
|
|
- name: place generated ssh_public_key for {{ user.name }}
|
|
authorized_key:
|
|
user: "{{ user.name }}"
|
|
state: present
|
|
key: "{{ item.stdout }}"
|
|
with_items:
|
|
- "{{ ssh_public_key }}"
|
|
when:
|
|
- ssh_public_key is defined
|
|
- user.manage_ssh_key is defined
|
|
- user.manage_ssh_key | bool
|
|
loop_control:
|
|
label: "{{ user.name }}"
|
|
|
|
- name: copy generated private ssh key for {{ user.name }}
|
|
copy:
|
|
src: "{{ users_ssh_key_directory }}/{{ item.name }}"
|
|
dest: "{{ item.home }}/.ssh/id_rsa"
|
|
mode: "0400"
|
|
owner: "{{ item.name }}"
|
|
group: "{{ item.group }}"
|
|
with_items:
|
|
- "{{ users_manage_user }}"
|
|
when:
|
|
- users_manage_user is defined
|
|
- user.copy_private_key is defined
|
|
- user.copy_private_key | bool
|
|
loop_control:
|
|
label: "{{ user.name }}"
|