Dmitry
39 lines
1.2 KiB
YAML
39 lines
1.2 KiB
YAML
- name: Bootstrap Ansible service account
|
|
hosts: shell_hosts
|
|
gather_facts: true
|
|
become: true
|
|
vars:
|
|
ansible_service_user: ansible
|
|
ansible_service_public_key_file: ~/.ssh/id_ed25519_homelab_ansible.pub
|
|
ansible_service_sudoers_file: /etc/sudoers.d/99-ansible-service-user
|
|
|
|
tasks:
|
|
- name: Read local Ansible service public key
|
|
ansible.builtin.set_fact:
|
|
ansible_service_public_key: "{{ lookup('file', ansible_service_public_key_file) }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Ensure Ansible service user exists
|
|
ansible.builtin.user:
|
|
name: "{{ ansible_service_user }}"
|
|
shell: /bin/bash
|
|
create_home: true
|
|
state: present
|
|
|
|
- name: Install Ansible service SSH key
|
|
ansible.posix.authorized_key:
|
|
user: "{{ ansible_service_user }}"
|
|
key: "{{ ansible_service_public_key }}"
|
|
state: present
|
|
exclusive: true
|
|
|
|
- name: Allow passwordless sudo for Ansible service user
|
|
ansible.builtin.copy:
|
|
dest: "{{ ansible_service_sudoers_file }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
content: "{{ ansible_service_user }} ALL=(ALL) NOPASSWD: ALL\n"
|
|
validate: /usr/sbin/visudo -cf %s
|