diff --git a/jaydee_init.yml b/jaydee_init.yml new file mode 100755 index 0000000..29216d1 --- /dev/null +++ b/jaydee_init.yml @@ -0,0 +1,43 @@ +$ANSIBLE_VAULT;1.1;AES256 +36386231366666386638313239386666336365633430363836646465353730653666383537663638 +6137363432353430623530383031303866306130613439320a323030626234356339323763393437 +30653136656534663139373334336436623837626230633162363330666164356262363132366261 +3865653337623138630a666562376132383566323665363165303136376234313762653134656637 +33613931643136333263653637373933623565383761343563373962326636356138633563396164 +33323139336361373639623136333763316466323562636362313762333766366133373036343766 +33656230343235313933646336333830626362616333346166336232613036653637396233663465 +38623334343364303861643336373730663864363539396364623335306132383633363934393966 +39633066316562313738313437643366613662653162363163613031316336633764376331646432 +30356133316635336562383136323932643234386630616530623037336530376533653734346166 +37653031623666383564396438353130326236346366303133356366663861636631356563396631 +38336165623431663536616332643130353330643563313230643465613934326531643934316562 +30393037313763373037663264376164646337623133616263333765363038323363376164366537 +34666139353563396264323935653038376139396534313237613731393461343631633162666332 +62313135663161343238386539393134333034653966636530383537323832613664613935393136 +32303963316161363734333864393634636238656335353563646333636632353165636633383532 +32313162633138663562636237633639343264663461656466383563383231653866636431643231 +64656664366361363538613565633566383533643732353936386130626431376233646134353732 +39363834363331333639653464663334353466626330643236373135626134393436643039363666 +31613337613832646636386432636365376132643565626337663933396565326539323466633166 +34623634306137633030336232663534626262623164333165363134323861363533323236663633 +65643464356237636363363734373232313564333963623363313634663134366166303161636537 +62626335336665663064363331633964353733393838316133623666323431373439353932373531 +63323738616636393462643364336262336664373662323534326362326161303938376336323166 +62383034356232613466366564306332386330643332623735303632393437666133616365326437 +66383236663731613364393231306439363765323339306436306261306134663433386134616437 +61613135643365653234363862303739366531613861346562643364333165366130626636613234 +63373833666638333866363733383539653263343535393531383366353731616630303433653732 +38326633343764323539333064633138626637353332353334336133623862393937376434663837 +33366561353934353035633132666336356330306232633064643461383266643432663134663139 +34393662326366643630666236343834646462313966373736366663356365353034376632376263 +30383335623765323163346361386334633866346166323962363234653662666334653436326465 +66323837613030313630663139306562663939323861346130653732643263323432666234626530 +62643633333966316133363137323464393062363039356634656237653438316362363161376238 +38333938343231616266653638393562343838353866393965326134313661366164353239626235 +30633566653566643966346632646133666662323733613863633534363061633438333534333461 +61353831623831646435353562623339303861393337353232643930323864646535653638646566 +38316130653161663534386532653162643734353462666562303930366537346238626266663631 +66636232383731636636353535643035643035626162623736353332663665336533636134663537 +63393439616130356164616230323533653536666638343333383839613361646262336266323866 +39616661623130653162623231383832663066316263343836356139346139303734386265393134 +6137303333626461303130353930623238613363313763663631 diff --git a/roles/init copy/files/id_rsa.pub b/roles/init copy/files/id_rsa.pub new file mode 100644 index 0000000..3cba7f1 --- /dev/null +++ b/roles/init copy/files/id_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjPi74gAHT2GBbKWWmmUrzzrhKQN3mnz3DTWn02KhbgWs6MRLlTrn2fLqB4hkoVEOat29wAOJ2xuY4aEjGfO6nl/3ka3oqslwxW9GqFCRXVHnF3b+Wly+jkn3tbht+gjFK4x0np1WZbpTI/nR7gElWa774LCHy5i4fm5ISoCHzRMsKd3dVF4YOte6QC9Uu4uQQjpZWksYRjANtXAk5EDEOERz+Dh8RDkXbGYW2vx1ihNQGh53z3c6W6bajGq3qx/+G905MtRgutbHWOOYSE8o2q3vaDkCNA6Fjd3P6gHTPcRjFEfoHc8Vxp0vjR9e6ol8X7D+GEL6g6QN656772Zo3/Qka0rJ/zMnT3gZ2S4i0CzmqDoecbzDCX7ywwuwgvlmJGOswgwwOKP/E0/RnWi63BUFV/fU9o5nr9ZXgkiRa9ZCzubHZhxyN6Z7EhcOVnMbvfV1W5Fn/vbj84YudCLmzrk5qvpQ+qVsMXi1GPIEyFwyg/Afu5JTpNE5+4ViFzTM= jd@morefine \ No newline at end of file diff --git a/roles/init copy/tasks/main.yml b/roles/init copy/tasks/main.yml new file mode 100755 index 0000000..56cdccd --- /dev/null +++ b/roles/init copy/tasks/main.yml @@ -0,0 +1,80 @@ +- name: Init + become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}" + block: + + - name: Include vault + ansible.builtin.include_vars: + file: init.yml + - name: Change password for jd + ansible.builtin.user: + name: jd + password: "{{ jd_password | password_hash('sha512') }}" + - name: "Ensure sudo binary exist" + stat: + path: /usr/bin/sudo + register: sudo_binary + - name: "Install sudo if not present" + package: + name: sudo + state: present + when: not sudo_binary.stat.exists + + - name: Check if group exists + getent: + database: group + key: sudo + register: group_check + ignore_errors: true + + - name: Ensure deploy user exists + ansible.builtin.user: + name: jd + shell: /bin/bash + groups: sudo + append: true + when: group_check is succeeded + - name: Ensure directory sudoers.d exists + file: + path: /etc/sudoers.d + state: directory + owner: root + group: root + mode: '0755' + + - name: Give jd passwordless sudo + copy: + dest: /etc/sudoers.d/jd + content: "jd ALL=(ALL) NOPASSWD:ALL\n" + owner: root + group: root + mode: '0440' + + - name: Change password for root + ansible.builtin.user: + name: root + password: "{{ jd_password | password_hash('sha512') }}" + + - name: Update become password for subsequent tasks + ansible.builtin.set_fact: + ansible_become_password: "{{ jd_password }}" + + - name: Add authorized SSH key + ansible.posix.authorized_key: + user: "jd" + key: "{{ lookup('file', 'id_rsa.pub') }}" + state: present + + - name: Set timezone to Europe/Bratislava + ansible.builtin.command: + cmd: timedatectl set-timezone Europe/Bratislava + args: + creates: /etc/timezone + - name: Set hostname + ansible.builtin.hostname: + name: "{{ inventory_hostname }}" + - name: Add host entry to /etc/hosts + ansible.builtin.lineinfile: + path: /etc/hosts + regexp: "^127.0.0.1 .*" + line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}" + state: present diff --git a/roles/init copy/vars/main.yml b/roles/init copy/vars/main.yml new file mode 100644 index 0000000..9035ae3 --- /dev/null +++ b/roles/init copy/vars/main.yml @@ -0,0 +1,4 @@ +username: "jd" +user_password: "{{ 'l4c1j4yd33Du5lo' | password_hash('sha512') }}" +new_root_password: "{{ 'l4c1j4yd33Du5lo' | password_hash('sha512') }}" +user_groups: "sudo" diff --git a/roles/init/handlers/main.yml b/roles/init/handlers/main.yml new file mode 100644 index 0000000..650681d --- /dev/null +++ b/roles/init/handlers/main.yml @@ -0,0 +1,4 @@ +- name: Restart sshd + ansible.builtin.service: + name: sshd + state: restarted \ No newline at end of file diff --git a/roles/ssh_config copy/files/config b/roles/ssh_config copy/files/config new file mode 100755 index 0000000..3c8f945 --- /dev/null +++ b/roles/ssh_config copy/files/config @@ -0,0 +1,26 @@ +Host m-server + HostName m-server.home.lan + +Host rpi5 + HostName rpi5.home.lan + +Host rack + HostName rack.home.lan + +Host amd + HostName amd.home.lan + +Host nas + HostName nas.home.lan + User admin + +Host router + HostName router.home.lan + User root +Host external + HostName 193.168.144.164 + User root +Host * + User jd + IdentityFile ~/.ssh/id_rsa + StrictHostKeyChecking no \ No newline at end of file diff --git a/roles/ssh_config copy/tasks/main.yml b/roles/ssh_config copy/tasks/main.yml new file mode 100755 index 0000000..d599651 --- /dev/null +++ b/roles/ssh_config copy/tasks/main.yml @@ -0,0 +1,22 @@ +- name: SSH config Setup + become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}" + block: + - name: Include vault + ansible.builtin.include_vars: + file: jaydee.yml + - name: Upload config + ansible.builtin.copy: + src: config + dest: /home/jd/.ssh/config + mode: '0600' + owner: jd + group: jd + when: inventory_hostname != 'nas.home.lan' + - name: Upload config + ansible.builtin.copy: + src: config + dest: /root/.ssh/config + mode: '0600' + owner: root + group: root + when: inventory_hostname != 'nas.home.lan' diff --git a/roles/ssh_config copy/vars/main.yml b/roles/ssh_config copy/vars/main.yml new file mode 100755 index 0000000..a63bf71 --- /dev/null +++ b/roles/ssh_config copy/vars/main.yml @@ -0,0 +1 @@ +dest_folder: "/tmp/ans_repo"