Dmitry
86 lines
2.9 KiB
YAML
86 lines
2.9 KiB
YAML
- name: Ensure user exists
|
|
ansible.builtin.user:
|
|
name: "{{ bootstrap_user }}"
|
|
shell: /bin/bash
|
|
groups: sudo
|
|
append: true
|
|
create_home: true
|
|
state: present
|
|
|
|
# docker group создаётся только после установки Docker.
|
|
# Добавление происходит в роли docker, не здесь.
|
|
|
|
- name: Add SSH authorized keys
|
|
ansible.posix.authorized_key:
|
|
user: "{{ bootstrap_user }}"
|
|
key: "{{ item }}"
|
|
state: present
|
|
loop: "{{ bootstrap_ssh_public_keys }}"
|
|
when: bootstrap_ssh_public_keys | length > 0
|
|
|
|
- name: Gather service facts
|
|
ansible.builtin.service_facts:
|
|
|
|
- name: Ensure Docker config directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/docker
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Configure Docker registry mirrors
|
|
ansible.builtin.copy:
|
|
dest: /etc/docker/daemon.json
|
|
content: "{{ {'registry-mirrors': docker_registry_mirrors} | to_nice_json }}\n"
|
|
mode: "0644"
|
|
register: docker_daemon_config
|
|
when: docker_registry_mirrors | length > 0
|
|
|
|
- name: Restart Docker after daemon config change
|
|
ansible.builtin.service:
|
|
name: docker
|
|
state: restarted
|
|
when:
|
|
- docker_daemon_config is changed
|
|
- "'docker.service' in ansible_facts.services"
|
|
|
|
# Команды, которые реально нужны без пароля:
|
|
# apt / apt-get — обновление пакетов
|
|
# systemctl — управление сервисами
|
|
# ufw — фаервол
|
|
# resticprofile — установка systemd-таймеров бэкапа
|
|
#
|
|
# Ansible become НЕ входит в этот список намеренно:
|
|
# для плейбуков запускать с -K. Это сознательный компромисс
|
|
# между удобством и тем, чтобы не давать python3 NOPASSWD (= root).
|
|
- name: Configure sudoers — NOPASSWD for specific commands
|
|
ansible.builtin.copy:
|
|
dest: /etc/sudoers.d/{{ bootstrap_user }}
|
|
content: |
|
|
{{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get
|
|
{{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/systemctl
|
|
{{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/bin/ufw
|
|
{{ bootstrap_user }} ALL=(ALL) NOPASSWD: /usr/local/bin/resticprofile
|
|
validate: /usr/sbin/visudo -cf %s
|
|
mode: "0440"
|
|
|
|
# Drop-in конфиг — не трогаем основной sshd_config.
|
|
# Требует Debian 12+ (OpenSSH 8.9+).
|
|
- name: Harden SSH
|
|
ansible.builtin.copy:
|
|
dest: /etc/ssh/sshd_config.d/99-hardening.conf
|
|
content: |
|
|
PasswordAuthentication no
|
|
PermitRootLogin no
|
|
PubkeyAuthentication yes
|
|
mode: "0644"
|
|
notify: restart sshd
|
|
|
|
- name: Ensure sshd_config.d is included
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
line: Include /etc/ssh/sshd_config.d/*.conf
|
|
state: present
|
|
insertbefore: BOF
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
notify: restart sshd
|