barker/frank/ansible/bake-pies.yml

#################################################
# DO Community Playbooks: Docker
#################################################
---
- name: Bake pies
  hosts: all
  become: true
  vars_files:
    - vars/pies.yml

  tasks:
    # - name: Check if LCD Rotated
    #   shell: grep -c "lcd_rotate=2" /boot/config.txt || true
    #   register: lcd_rotate_test

    # - name: rotate the lcd
    #   lineinfile:
    #     dest: /boot/config.txt
    #     line: lcd_rotate=2
    #   when: lcd_rotate_test.stdout == "0"

    - name: Update the hostname file
      ansible.builtin.replace:
        path: /etc/hostname
        regexp: "(\\s*)raspberrypi(\\s+.*)?$"
        replace: "\\1{{ hostname }}\\2"
        backup: true

    - name: Update the hosts file
      ansible.builtin.replace:
        path: /etc/hosts
        regexp: "(\\s+)raspberrypi(\\s+.*)?$"
        replace: "\\1{{ hostname }}\\2"
        backup: true

    - name: Ensure SSH Directory exists
      ansible.builtin.file:
        path: "/home/{{ user }}/.ssh"
        state: directory
        group: "{{ user }}"
        owner: "{{ user }}"
        mode: "0700"

    - name: Ensure authorized_keys file exists
      ansible.builtin.copy:
        content: ""
        dest: "/home/{{ user }}/.ssh/authorized_keys"
        force: false
        group: "{{ user }}"
        owner: "{{ user }}"
        mode: "0644"

    - name: Check Terminus public key
      ansible.builtin.shell: "grep -c \"{{ terminus_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
      register: terminuskey_test
      changed_when: false

    - name: Add Terminus public key
      ansible.builtin.lineinfile:
        dest: "/home/{{ user }}/.ssh/authorized_keys"
        line: "{{ terminus_key }}"
      when: terminuskey_test.stdout == "0"

    - name: Check clair public key
      ansible.builtin.shell: "grep -c \"{{ clair_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
      register: clairkey_test
      changed_when: false

    - name: Add clair public key
      ansible.builtin.lineinfile:
        dest: "/home/{{ user }}/.ssh/authorized_keys"
        line: "{{ clair_key }}"
      when: clairkey_test.stdout == "0"

    - name: Check Anjin public key
      ansible.builtin.shell: "grep -c \"{{ anjin_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
      register: anjin_key_test
      changed_when: false

    - name: Add Anjin public key
      ansible.builtin.lineinfile:
        dest: "/home/{{ user }}/.ssh/authorized_keys"
        line: "{{ anjin_key }}"
      when: anjin_key_test.stdout == "0"

    - name: Update the sshd config file to disable password logins
      ansible.builtin.replace:
        path: /etc/ssh/sshd_config
        regexp: "(\\s+)#PasswordAuthentication yes(\\s+.*)?$"
        replace: "\\1PasswordAuthentication no\\2"
        backup: true

    - name: Check if .ssh config file exists
      ansible.builtin.stat:
        path: "/home/{{ user }}/.ssh/config"
      register: config_status

    - name: No need to upload the .ssh config
      when: config_status.stat.exists
      ansible.builtin.debug:
        msg: No need to upload the .ssh config as it already exists.

    - name: Upload the .ssh config file
      when: not config_status.stat.exists
      ansible.builtin.template:
        src: "files/config"
        dest: "/home/{{ user }}/.ssh/config"
        group: "{{ user }}"
        owner: "{{ user }}"
        mode: "0644"

    - name: Check if ed25519 key exists
      ansible.builtin.stat:
        path: "/home/{{ user }}/.ssh/id_ed25519"
      register: key_status

    - name: No need to generate new ed25519 key
      when: key_status.stat.exists
      ansible.builtin.debug:
        msg: No need to generate new ed25519 key as it already exists.

    - name: Generate new id_ed25519 key
      when: not key_status.stat.exists
      become: true
      become_user: "{{ user }}"
      ansible.builtin.shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ hostname }} $(date '+%Y.%m.%d')" -N ""
      changed_when: true

    - name: Install Docker
      ansible.builtin.shell: curl -sSL https://get.docker.com | sh # noqa command-instead-of-module risky-shell-pipe
      changed_when: true

    - name: Install matchbox-keyboard
      ansible.builtin.package:
        name: matchbox-keyboard
        state: present

    - name: Install python3-docker
      ansible.builtin.package:
        name: python3-docker
        state: present

    - name: Adding user to group docker
      ansible.builtin.user:
        name: "{{ user }}"
        groups: docker
        append: true

    - name: Adding user to group lp (line printers)
      ansible.builtin.user:
        name: "{{ user }}"
        groups: lp
        append: true

    - name: Install nats-tunnel systemd unit file
      ansible.builtin.template:
        src: "files/nats-tunnel.service"
        dest: "/etc/systemd/system/nats-tunnel.service"
        mode: "0644"

    - name: Enable service nats-tunnel and ensure it is not masked
      ansible.builtin.systemd:
        name: nats-tunnel
        enabled: true
        masked: false

    - name: Make sure nats-tunnel service is running
      ansible.builtin.systemd:
        state: started
        name: nats-tunnel

    - name: Install leardal systemd unit file
      ansible.builtin.template:
        src: "files/leardal.service"
        dest: "/etc/systemd/system/leardal.service"
        mode: "0644"

    - name: Enable service leardal and ensure it is not masked
      ansible.builtin.systemd:
        name: leardal
        enabled: true
        masked: false

    - name: Make sure leardal service is running
      ansible.builtin.systemd:
        state: started
        name: leardal

    - name: Check if NetBird is installed
      ansible.builtin.command: netbird --version
      register: netbird_installed
      ignore_errors: true
      changed_when: false

    - name: Install NetBird client
      ansible.builtin.shell: curl -fsSL https://pkgs.netbird.io/install.sh | sh
      when: netbird_installed.rc != 0
      changed_when: true

    - name: Connect NetBird to management server
      ansible.builtin.command: >
        netbird up --management-url {{ netbird_management_url }} --setup-key {{ netbird_setup_key }}
      when: netbird_installed.rc != 0
      changed_when: true