81 lines
2.1 KiB
YAML
81 lines
2.1 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# FILE: roles/common/tasks/main.yml
|
|
# DESCRIPTION: Baseline configuration applied to all managed hosts.
|
|
# Handles hostname, timezone, core packages, NTP, and
|
|
# ansible user setup.
|
|
# ------------------------------------------------------------------------------
|
|
|
|
- name: Set hostname
|
|
hostname:
|
|
name: "{{ inventory_hostname | replace('_', '-') }}"
|
|
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ common_timezone }}"
|
|
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install base utility packages
|
|
apt:
|
|
name: "{{ common_packages }}"
|
|
state: present
|
|
|
|
- name: Install chrony
|
|
apt:
|
|
name: chrony
|
|
state: present
|
|
|
|
- name: Configure chrony to use sundial
|
|
template:
|
|
src: chrony.conf.j2
|
|
dest: /etc/chrony/chrony.conf
|
|
mode: '0644'
|
|
notify: restart chrony
|
|
|
|
- name: Ensure chrony is enabled and running
|
|
systemd:
|
|
name: chrony
|
|
state: started
|
|
enabled: yes
|
|
|
|
- name: Ensure ansible user has sudo without password
|
|
lineinfile:
|
|
path: /etc/sudoers.d/{{ ansible_user }}
|
|
line: "{{ ansible_user }} ALL=(ALL) NOPASSWD:ALL"
|
|
create: yes
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
|
|
# --- Step-CA SSH certificate enrollment ---
|
|
- name: Enroll host in step-ca SSH CA
|
|
include_tasks: step_ca_client.yml
|
|
|
|
- name: Create authorized principals directory
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/auth_principals
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Create authorized principals files
|
|
ansible.builtin.copy:
|
|
content: "{{ item.principals | join('\n') }}\n"
|
|
dest: "/etc/ssh/auth_principals/{{ item.local_user }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
loop: "{{ step_ca_principal_mappings }}"
|
|
notify: restart sshd
|
|
|
|
- name: Configure sshd AuthorizedPrincipalsFile
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
line: "AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u"
|
|
regexp: "^#?AuthorizedPrincipalsFile"
|
|
state: present
|
|
notify: restart sshd
|
|
|