build-all

jaydee_init.yml

@@ -0,0 +1,43 @@
+$ANSIBLE_VAULT;1.1;AES256
+36386231366666386638313239386666336365633430363836646465353730653666383537663638
+6137363432353430623530383031303866306130613439320a323030626234356339323763393437
+30653136656534663139373334336436623837626230633162363330666164356262363132366261
+3865653337623138630a666562376132383566323665363165303136376234313762653134656637
+33613931643136333263653637373933623565383761343563373962326636356138633563396164
+33323139336361373639623136333763316466323562636362313762333766366133373036343766
+33656230343235313933646336333830626362616333346166336232613036653637396233663465
+38623334343364303861643336373730663864363539396364623335306132383633363934393966
+39633066316562313738313437643366613662653162363163613031316336633764376331646432
+30356133316635336562383136323932643234386630616530623037336530376533653734346166
+37653031623666383564396438353130326236346366303133356366663861636631356563396631
+38336165623431663536616332643130353330643563313230643465613934326531643934316562
+30393037313763373037663264376164646337623133616263333765363038323363376164366537
+34666139353563396264323935653038376139396534313237613731393461343631633162666332
+62313135663161343238386539393134333034653966636530383537323832613664613935393136
+32303963316161363734333864393634636238656335353563646333636632353165636633383532
+32313162633138663562636237633639343264663461656466383563383231653866636431643231
+64656664366361363538613565633566383533643732353936386130626431376233646134353732
+39363834363331333639653464663334353466626330643236373135626134393436643039363666
+31613337613832646636386432636365376132643565626337663933396565326539323466633166
+34623634306137633030336232663534626262623164333165363134323861363533323236663633
+65643464356237636363363734373232313564333963623363313634663134366166303161636537
+62626335336665663064363331633964353733393838316133623666323431373439353932373531
+63323738616636393462643364336262336664373662323534326362326161303938376336323166
+62383034356232613466366564306332386330643332623735303632393437666133616365326437
+66383236663731613364393231306439363765323339306436306261306134663433386134616437
+61613135643365653234363862303739366531613861346562643364333165366130626636613234
+63373833666638333866363733383539653263343535393531383366353731616630303433653732
+38326633343764323539333064633138626637353332353334336133623862393937376434663837
+33366561353934353035633132666336356330306232633064643461383266643432663134663139
+34393662326366643630666236343834646462313966373736366663356365353034376632376263
+30383335623765323163346361386334633866346166323962363234653662666334653436326465
+66323837613030313630663139306562663939323861346130653732643263323432666234626530
+62643633333966316133363137323464393062363039356634656237653438316362363161376238
+38333938343231616266653638393562343838353866393965326134313661366164353239626235
+30633566653566643966346632646133666662323733613863633534363061633438333534333461
+61353831623831646435353562623339303861393337353232643930323864646535653638646566
+38316130653161663534386532653162643734353462666562303930366537346238626266663631
+66636232383731636636353535643035643035626162623736353332663665336533636134663537
+63393439616130356164616230323533653536666638343333383839613361646262336266323866
+39616661623130653162623231383832663066316263343836356139346139303734386265393134
+6137303333626461303130353930623238613363313763663631

roles/init copy/files/id_rsa.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjPi74gAHT2GBbKWWmmUrzzrhKQN3mnz3DTWn02KhbgWs6MRLlTrn2fLqB4hkoVEOat29wAOJ2xuY4aEjGfO6nl/3ka3oqslwxW9GqFCRXVHnF3b+Wly+jkn3tbht+gjFK4x0np1WZbpTI/nR7gElWa774LCHy5i4fm5ISoCHzRMsKd3dVF4YOte6QC9Uu4uQQjpZWksYRjANtXAk5EDEOERz+Dh8RDkXbGYW2vx1ihNQGh53z3c6W6bajGq3qx/+G905MtRgutbHWOOYSE8o2q3vaDkCNA6Fjd3P6gHTPcRjFEfoHc8Vxp0vjR9e6ol8X7D+GEL6g6QN656772Zo3/Qka0rJ/zMnT3gZ2S4i0CzmqDoecbzDCX7ywwuwgvlmJGOswgwwOKP/E0/RnWi63BUFV/fU9o5nr9ZXgkiRa9ZCzubHZhxyN6Z7EhcOVnMbvfV1W5Fn/vbj84YudCLmzrk5qvpQ+qVsMXi1GPIEyFwyg/Afu5JTpNE5+4ViFzTM= jd@morefine

roles/init copy/tasks/main.yml

@@ -0,0 +1,80 @@
+- name: Init
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  block:
+    
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: init.yml
+    - name: Change password for jd
+      ansible.builtin.user:
+        name: jd
+        password: "{{ jd_password | password_hash('sha512') }}"
+    - name: "Ensure sudo binary  exist"
+      stat:
+        path: /usr/bin/sudo
+      register: sudo_binary
+    - name: "Install sudo if not present"
+      package:
+        name: sudo
+        state: present
+      when: not sudo_binary.stat.exists
+    
+    - name: Check if group exists
+      getent:
+        database: group
+        key: sudo
+      register: group_check
+      ignore_errors: true
+      
+    - name: Ensure deploy user exists
+      ansible.builtin.user:
+        name: jd
+        shell: /bin/bash
+        groups: sudo
+        append: true
+      when: group_check is succeeded
+    - name: Ensure directory sudoers.d exists
+      file:
+        path: /etc/sudoers.d
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+  
+    - name: Give jd passwordless sudo
+      copy:
+        dest: /etc/sudoers.d/jd
+        content: "jd ALL=(ALL) NOPASSWD:ALL\n"
+        owner: root
+        group: root
+        mode: '0440'
+
+    - name: Change password for root
+      ansible.builtin.user:
+        name: root
+        password: "{{ jd_password | password_hash('sha512') }}"
+
+    - name: Update become password for subsequent tasks
+      ansible.builtin.set_fact:
+        ansible_become_password: "{{ jd_password }}"
+
+    - name: Add authorized SSH key
+      ansible.posix.authorized_key:
+        user: "jd"
+        key: "{{ lookup('file', 'id_rsa.pub') }}"
+        state: present
+
+    - name: Set timezone to Europe/Bratislava
+      ansible.builtin.command:
+        cmd: timedatectl set-timezone Europe/Bratislava
+      args:
+        creates: /etc/timezone
+    - name: Set hostname
+      ansible.builtin.hostname:
+        name: "{{ inventory_hostname }}"
+    - name: Add host entry to /etc/hosts
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        regexp: "^127.0.0.1 .*"
+        line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
+        state: present

roles/init copy/vars/main.yml

@@ -0,0 +1,4 @@
+username: "jd"
+user_password: "{{ 'l4c1j4yd33Du5lo' | password_hash('sha512') }}"
+new_root_password: "{{ 'l4c1j4yd33Du5lo' | password_hash('sha512') }}"
+user_groups: "sudo"

roles/init/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: Restart sshd
+  ansible.builtin.service:
+    name: sshd
+    state: restarted

roles/ssh_config copy/files/config

@@ -0,0 +1,26 @@
+Host m-server
+  HostName m-server.home.lan
+ 
+Host rpi5
+  HostName rpi5.home.lan
+
+Host rack
+  HostName rack.home.lan
+
+Host amd
+  HostName amd.home.lan
+  
+Host nas
+  HostName nas.home.lan
+  User admin
+
+Host router
+  HostName router.home.lan
+  User root
+Host external
+  HostName 193.168.144.164
+  User root
+Host *
+    User jd
+    IdentityFile ~/.ssh/id_rsa
+    StrictHostKeyChecking no

roles/ssh_config copy/tasks/main.yml

@@ -0,0 +1,22 @@
+- name: SSH config Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+    - name: Upload config
+      ansible.builtin.copy:
+        src: config
+        dest: /home/jd/.ssh/config
+        mode: '0600'
+        owner: jd
+        group: jd
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload config
+      ansible.builtin.copy:
+        src: config
+        dest: /root/.ssh/config
+        mode: '0600'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'

roles/ssh_config copy/vars/main.yml

@@ -0,0 +1 @@
+dest_folder: "/tmp/ans_repo"