55 lines
1.4 KiB
YAML
55 lines
1.4 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# FILE: roles/common/tasks/main.yml
|
|
# DESCRIPTION: Baseline configuration applied to all managed hosts.
|
|
# Handles hostname, timezone, core packages, NTP, and
|
|
# ansible user setup.
|
|
# ------------------------------------------------------------------------------
|
|
|
|
- name: Set hostname
|
|
hostname:
|
|
name: "{{ inventory_hostname | replace('_', '-') }}"
|
|
|
|
- name: Set timezone
|
|
timezone:
|
|
name: "{{ common_timezone }}"
|
|
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install base utility packages
|
|
apt:
|
|
name: "{{ common_packages }}"
|
|
state: present
|
|
|
|
- name: Install chrony
|
|
apt:
|
|
name: chrony
|
|
state: present
|
|
|
|
- name: Configure chrony to use sundial
|
|
template:
|
|
src: chrony.conf.j2
|
|
dest: /etc/chrony/chrony.conf
|
|
mode: '0644'
|
|
notify: restart chrony
|
|
|
|
- name: Ensure chrony is enabled and running
|
|
systemd:
|
|
name: chrony
|
|
state: started
|
|
enabled: yes
|
|
|
|
- name: Ensure ansible user has sudo without password
|
|
lineinfile:
|
|
path: /etc/sudoers.d/{{ ansible_user }}
|
|
line: "{{ ansible_user }} ALL=(ALL) NOPASSWD:ALL"
|
|
create: yes
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
|
|
# --- Step-CA SSH certificate enrollment ---
|
|
- name: Enroll host in step-ca SSH CA
|
|
include_tasks: step_ca_client.yml
|