diff --git a/ansible/inventories/group_vars/all/bootstrap_info.yaml b/ansible/inventories/group_vars/all/bootstrap_info.yaml new file mode 100644 index 0000000..76898ac --- /dev/null +++ b/ansible/inventories/group_vars/all/bootstrap_info.yaml @@ -0,0 +1,4 @@ +--- +ansible_authorized_keys: + - label : hassallah + key: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ== \ No newline at end of file diff --git a/ansible/playbooks/README.md b/ansible/playbooks/README.md new file mode 100644 index 0000000..2615dc5 --- /dev/null +++ b/ansible/playbooks/README.md @@ -0,0 +1,30 @@ +# Playbooks + +Qui vengono riportati i playbook disponibili, descrizione e utilizzo. +**NB** Ci si aspetta che i playbook siano idempotenti. In caso contrario e' importante riportarlo nella documentazione corrente. + +### Bootstrap +Implementa la configurazione di base di un nodo per poter essere gestito dagli altri playbook, in particolare : +- crea l'utente ansible +- registra le chiavi ssh degli utenti configurati + + + +#### Parametri +Il playbook si aspetta le seguenti variabili +``` +ansible_authorized_keys: + - label : + key: +``` + + +#### Chiamata +Per lanciare il playbook e' necessario specificare l'utente da utilizzare per connettersi ed esguire il playbook con l'opzione *-e*'. +L'opzione '*-K*' invece permette di chiedere la password dell'utente remoto + +``` + ansible-playbook -i inventories/.yaml playbooks/bootstrap.yaml -e 'ansible_user=' -K +``` + +### VPN Server \ No newline at end of file diff --git a/ansible/playbooks/bootstrap.yaml b/ansible/playbooks/bootstrap.yaml new file mode 100644 index 0000000..706ab17 --- /dev/null +++ b/ansible/playbooks/bootstrap.yaml @@ -0,0 +1,70 @@ +- hosts: all + become: yes + #debugger: on_failed + tasks: + - name: Add the ansible group + group: + name: ansible + gid: 1100 + state: present + + - name: Add the ansible user as a system user + user: + name: ansible + uid: 1100 + group: ansible + # Directly generate hash + # https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/ + password: "{{ ansible_crypted_password | password_hash('sha512') }}" + shell: /bin/bash + # Uncomment to prevent password reset + update_password: on_create + system: yes + home: /home/ansible + state: present + + - name: Set ansible user as sudoer + copy: + content: "ansible ALL = (ALL) NOPASSWD:ALL" + dest: /etc/sudoers.d/ansible + owner: root + group: root + mode: 0440 + + + - name: Init cache directory + ansible.builtin.file: + path: /var/cache/ansible + owner: ansible + group: ansible + state: directory + mode: u=rwx,g=rw,o=r + + - name: Init etc directory + ansible.builtin.file: + path: /etc/ansible + owner: ansible + group: ansible + state: directory + mode: u=rwx,g=rw,o=r + + +# Inserts public keys of allowed externals users to log in as ansible +# e.g. fabio + + - name: Create the .ssh directory + file: + path: /home/ansible/.ssh + owner: ansible + group: ansible + mode: 0700 + state: directory + + - name: Add the mandatory ssh keys to the ansible user + template: + src: templates/ansible_auth_keys.j2 + dest: /home/ansible/.ssh/authorized_keys + owner: ansible + group: ansible + mode: 0600 + diff --git a/ansible/playbooks/templates/ansible_auth_keys.j2 b/ansible/playbooks/templates/ansible_auth_keys.j2 new file mode 100644 index 0000000..3748af3 --- /dev/null +++ b/ansible/playbooks/templates/ansible_auth_keys.j2 @@ -0,0 +1,4 @@ +{% for item in to_set_authorized_keys %} +{{ '#' }} Key for {{ item.label }} +{{ item.Key }} +{% endfor %} \ No newline at end of file