ansible/roles/init/tasks/main.yml

- name: Init
  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
  block:
    
    - name: Include vault
      ansible.builtin.include_vars:
        file: init.yml
    - name: Change password for jd
      ansible.builtin.user:
        name: jd
        password: "{{ jd_password | password_hash('sha512') }}"
    - name: "Ensure sudo binary  exist"
      stat:
        path: /usr/bin/sudo
      register: sudo_binary
    - name: "Install sudo if not present"
      package:
        name: sudo
        state: present
      when: not sudo_binary.stat.exists
    
    - name: Check if group exists
      getent:
        database: group
        key: sudo
      register: group_check
      ignore_errors: true
      
    - name: Ensure deploy user exists
      ansible.builtin.user:
        name: jd
        shell: /bin/bash
        groups: sudo
        append: true
      when: group_check is succeeded
    - name: Ensure directory sudoers.d exists
      file:
        path: /etc/sudoers.d
        state: directory
        owner: root
        group: root
        mode: '0755'
  
    - name: Give jd passwordless sudo
      copy:
        dest: /etc/sudoers.d/jd
        content: "jd ALL=(ALL) NOPASSWD:ALL\n"
        owner: root
        group: root
        mode: '0440'

    - name: Change password for root
      ansible.builtin.user:
        name: root
        password: "{{ jd_password | password_hash('sha512') }}"

    - name: Update become password for subsequent tasks
      ansible.builtin.set_fact:
        ansible_become_password: "{{ jd_password }}"

    - name: Set timezone to Europe/Bratislava
      ansible.builtin.command:
        cmd: timedatectl set-timezone Europe/Bratislava
      args:
        creates: /etc/timezone
    - name: Set hostname
      ansible.builtin.hostname:
        name: "{{ inventory_hostname }}"
    - name: Add host entry to /etc/hosts
      ansible.builtin.lineinfile:
        path: /etc/hosts
        regexp: "^127.0.0.1 .*"
        line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
        state: present

    - name: Install required dependencies
      ansible.builtin.dnf:
        name:
          - dnf-plugins-core
          - curl
        state: present

    - name: Add HashiCorp repository
      ansible.builtin.get_url:
        url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
        dest: /etc/yum.repos.d/hashicorp.repo
        mode: "0644"

    - name: Clean DNF cache
      ansible.builtin.command: dnf clean all
      changed_when: false

    - name: Install Vault
      ansible.builtin.dnf:
        name: vault
        state: present
        update_cache: yes

    - name: Set vault address
      copy:
        dest: /etc/profile.d/vault.sh
        content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
        owner: root
        group: root
        mode: '0440'