Bootstrap playbook

ansible/inventories/group_vars/all/bootstrap_info.yaml

@@ -0,0 +1,4 @@
+---
+ansible_authorized_keys:
+  - label : hassallah
+    key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ==

ansible/playbooks/README.md

@@ -0,0 +1,30 @@
+# Playbooks
+
+Qui vengono riportati i playbook disponibili, descrizione e utilizzo. 
+**NB** Ci si aspetta che i playbook siano idempotenti. In caso contrario e' importante riportarlo nella documentazione corrente. 
+
+### Bootstrap
+Implementa la configurazione di base di un nodo per poter essere gestito dagli altri playbook, in particolare : 
+- crea l'utente ansible
+- registra le chiavi ssh degli utenti configurati
+
+
+
+#### Parametri
+Il playbook si aspetta le seguenti variabili
+```
+ansible_authorized_keys:
+	- label : <MY LABEL>
+	  key: <MY>
+```
+
+
+#### Chiamata
+Per lanciare il playbook e' necessario specificare l'utente da utilizzare per connettersi ed esguire il playbook con l'opzione *-e*'.
+L'opzione '*-K*' invece permette di chiedere la password dell'utente remoto 
+
+```
+ ansible-playbook -i inventories/<INVENTORY>.yaml  playbooks/bootstrap.yaml -e 'ansible_user=<SUDO USER>' -K
+```
+
+### VPN Server

ansible/playbooks/bootstrap.yaml

@@ -0,0 +1,70 @@
+- hosts: all
+  become: yes
+  #debugger: on_failed
+  tasks:
+    - name: Add the ansible group
+      group:
+        name: ansible
+        gid: 1100
+        state: present
+
+    - name: Add the ansible user as a system user
+      user:
+        name: ansible
+        uid: 1100
+        group: ansible
+        # Directly generate hash 
+        # https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/
+        password: "{{ ansible_crypted_password | password_hash('sha512') }}"
+        shell: /bin/bash
+        # Uncomment to prevent password reset
+        update_password: on_create
+        system: yes
+        home: /home/ansible
+        state: present
+
+    - name: Set ansible user as sudoer
+      copy:
+        content: "ansible ALL = (ALL) NOPASSWD:ALL"
+        dest: /etc/sudoers.d/ansible
+        owner: root
+        group: root
+        mode: 0440
+
+
+    - name: Init cache directory
+      ansible.builtin.file:
+        path: /var/cache/ansible
+        owner: ansible
+        group: ansible
+        state: directory
+        mode: u=rwx,g=rw,o=r
+
+    - name: Init etc directory
+      ansible.builtin.file:
+        path: /etc/ansible
+        owner: ansible
+        group: ansible
+        state: directory
+        mode: u=rwx,g=rw,o=r
+
+
+# Inserts public keys of allowed externals users to log in as ansible 
+# e.g. fabio
+
+    - name: Create the .ssh directory
+      file: 
+        path: /home/ansible/.ssh 
+        owner: ansible
+        group: ansible
+        mode: 0700 
+        state: directory
+
+    - name: Add the mandatory ssh keys to the ansible user
+      template: 
+        src: templates/ansible_auth_keys.j2 
+        dest: /home/ansible/.ssh/authorized_keys 
+        owner: ansible 
+        group: ansible 
+        mode: 0600
+

ansible/playbooks/templates/ansible_auth_keys.j2

@@ -0,0 +1,4 @@
+{% for item in to_set_authorized_keys %}
+{{ '#' }} Key for {{ item.label }}
+{{ item.Key }}
+{% endfor %}