From dee5a45271ff5c1ff9e92d84a6392e7bbb9d51f1 Mon Sep 17 00:00:00 2001 From: Geno Date: Thu, 17 Sep 2020 12:55:13 +0000 Subject: [PATCH] roles/user_mgmt: for add/delete users and ssh_keys --- debian.yml | 1 + group_vars/all.yml | 18 ++++++++++++++++ host_vars/cloud.emma.ccchb.de.yml | 9 +++++++- host_vars/dn42.emma.ccchb.de.yml | 12 ++++++++++- roles/debian/tasks/main.yml | 6 ------ roles/user_mgmt/defaults/main.yml | 2 ++ roles/user_mgmt/tasks/main.yml | 34 +++++++++++++++++++++++++++++++ 7 files changed, 74 insertions(+), 8 deletions(-) create mode 100644 group_vars/all.yml create mode 100644 roles/user_mgmt/defaults/main.yml create mode 100644 roles/user_mgmt/tasks/main.yml diff --git a/debian.yml b/debian.yml index a80ff5f..5e48cde 100644 --- a/debian.yml +++ b/debian.yml @@ -3,3 +3,4 @@ become: yes roles: - debian + - { role: user_mgmt, tags: [user_mgmt]} diff --git a/group_vars/all.yml b/group_vars/all.yml new file mode 100644 index 0000000..fd77a4b --- /dev/null +++ b/group_vars/all.yml @@ -0,0 +1,18 @@ +user_mgmt_default: + crest: + ssh_key: + present: + - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGApbgicmP2yQTxf2YjGVtRo6yGTIFfDRjHg2whJsKp9 crest" + - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMmjzqbR1FPmfgwutxxog/UsbvXHx8uJMDAwBDOjV+XY crest@emma.ccchb.de" + absent: [] + genofire: + ssh_key: + present: + - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZm0TZPBzgXrY1vrLoYviNRb/oGZQDQk9vrppPK84sN55ZPlr9VvP+JYE7Qkx8teRuH9ulxqX40+dxKaiAXMUl4HU57KPLjwCb7SnBNIFTv6ZHGxPS8ZgUzKJr4Agph51oenNEO3RziEqAo3EwK67SGnjeIYQQKcjpfwd08+PYMOjv42zSYQ9umooj5LooOvbxoogZ3VpboXv6DeyA4rev1M9RgnMWaWVF2LxJjQ3jVr7xh1vZktVGKuVk/XXKD6WVAuwmGMVEouQzjtG9kepWd8FUYe+fgj5mtdqfeQP9CypxvOcb7jT20wO1Abpp5udS9iPDQHg+lafklIAeKG3qgxxhBDH3otXtnWcoeXUmDpBI8HU/8d/yrGaLHYRfy3HHiSGFq3lBgoxi83QIOl9ELeKWMJC0fWKBApm0NU0flgwfy2j7GRyXmlM7tVFyuj5RTAZNQfgD9g054di9WbtUs7sm/9r3/rQe2+3neE3Jskt4xvZK0xbc4dZSZGn4E2JDWjENqPBvQ2dU5lsjpUKTZWAnxVGPe//BErsDxNLIHWz8emG71r3Q2yud4KPdAR9CgeC8g1bwlCI6JDFZutKBzIlE3QQ4ryKJEioiUL89xi6G+nNB7W5ABsQN0ZtWvZl8TG4Wh00B+oBXzgRER5Y9SdAYcrwWxlGVxxQyElUNrw== genofire-yubikey" + - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8LdgjUiL/MFmA2wM98QAbUEyY/8ixnpettC6kQxKWu genofire@emma.ccchb.de" + absent: [] + fritz: + ssh_key: + present: + - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEay33koXmcBcrDuCQKkCBlw/gKiPtwLswATPqIR7udl fritz@fluorine.grimpen.net" + absent: [] diff --git a/host_vars/cloud.emma.ccchb.de.yml b/host_vars/cloud.emma.ccchb.de.yml index 2016859..87608c5 100644 --- a/host_vars/cloud.emma.ccchb.de.yml +++ b/host_vars/cloud.emma.ccchb.de.yml @@ -3,7 +3,6 @@ ipv6route: 2a01:4f8:150:926f::4 ipv4: 10.0.0.1/31 ipv4route: 10.0.0.0 dns: 213.133.98.98 8.8.8.8 -default_root_ssh_publickey: "https://fireorbit.de/keys/ssh" nginx_acme_mail: "webmaster@ccchb.de" nextcloud_domain: "cloud.ccchb.de" php_config: @@ -12,3 +11,11 @@ php_config: php_fpm_env: - key: 'PATH' value: "/usr/local/bin:/usr/bin:/bin" + +user_mgmt: + crest: + created: true + groups: sudo + genofire: + created: true + groups: sudo diff --git a/host_vars/dn42.emma.ccchb.de.yml b/host_vars/dn42.emma.ccchb.de.yml index cd48516..062fdfb 100644 --- a/host_vars/dn42.emma.ccchb.de.yml +++ b/host_vars/dn42.emma.ccchb.de.yml @@ -5,4 +5,14 @@ ipv6route: 2a01:4f8:150:926f::6 ipv4: 10.0.0.3/31 ipv4route: 10.0.0.2 dns: 213.133.98.98 8.8.8.8 -default_root_ssh_publickey: "https://fireorbit.de/keys/ssh" + +user_mgmt: + crest: + created: true + groups: sudo + genofire: + created: true + groups: sudo + fritz: + created: true + groups: sudo diff --git a/roles/debian/tasks/main.yml b/roles/debian/tasks/main.yml index 8f1119b..e79510a 100644 --- a/roles/debian/tasks/main.yml +++ b/roles/debian/tasks/main.yml @@ -11,12 +11,6 @@ checksum: sha256:ad88c76951693c2f9c38773ed2602a9fd5c74431615c4a23aaff679b295919ce validate_certs: false -- name: ssh publickey - authorized_key: - user: root - state: present - key: "{{ default_root_ssh_publickey }}" - - name: Update SSH configuration notify: reload sshd replace: diff --git a/roles/user_mgmt/defaults/main.yml b/roles/user_mgmt/defaults/main.yml new file mode 100644 index 0000000..17874ee --- /dev/null +++ b/roles/user_mgmt/defaults/main.yml @@ -0,0 +1,2 @@ +user_mgmt_default: {} +user_mgmt: {} diff --git a/roles/user_mgmt/tasks/main.yml b/roles/user_mgmt/tasks/main.yml new file mode 100644 index 0000000..00cdb15 --- /dev/null +++ b/roles/user_mgmt/tasks/main.yml @@ -0,0 +1,34 @@ +--- +- name: Merge ansible variables for host + set_fact: _user_mgmt="{{ user_mgmt_default | combine(user_mgmt, recursive=true) }}" + +- name: Add User + user: + name: "{{ item.key }}" + groups: "{{ item.value.groups | default([]) }}" + state: present + when: item.value.created | default + with_dict: "{{ _user_mgmt }}" + +- name: Add ssh-key to user + authorized_key: + user: "{{ item.0.key }}" + key: "{{ item.1 }}" + state: present + when: _user_mgmt[item.0.key].created | default + loop: "{{ _user_mgmt |dict2items | subelements('value.ssh_key.present') }}" + +- name: Remove ssh-key to user + authorized_key: + user: "{{ item.0.key }}" + key: "{{ item.1 }}" + state: absent + when: _user_mgmt[item.0.key].created | default + loop: "{{ _user_mgmt |dict2items | subelements('value.ssh_key.absent') }}" + +- name: Remove user + user: + name: "{{ item.key }}" + state: absent + when: not (item.value.created | default) + with_dict: "{{ _user_mgmt }}"