52 lines
1.7 KiB
YAML
52 lines
1.7 KiB
YAML
---
|
|
# Tasks for the common role.
|
|
#
|
|
# Runs in the second play, against the account the server was prepared for
|
|
# ({{ user }}). The .ssh directory and the authorized_keys entries are already
|
|
# in place by the time this runs: the user role installs them during the
|
|
# bootstrap play, because they are what makes logging in as {{ user }} --
|
|
# and therefore this play -- possible in the first place.
|
|
|
|
- name: Update the sshd config file to disable password logins
|
|
ansible.builtin.replace:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "(\\s+)#PasswordAuthentication yes(\\s+.*)?$"
|
|
replace: "\\1PasswordAuthentication no\\2"
|
|
backup: true
|
|
|
|
- name: Check if .ssh config file exists
|
|
ansible.builtin.stat:
|
|
path: "/home/{{ user }}/.ssh/config"
|
|
register: config_status
|
|
|
|
- name: No need to upload the .ssh config
|
|
when: config_status.stat.exists
|
|
ansible.builtin.debug:
|
|
msg: No need to upload the .ssh config as it already exists.
|
|
|
|
- name: Upload the .ssh config file
|
|
when: not config_status.stat.exists
|
|
ansible.builtin.template:
|
|
src: "files/config"
|
|
dest: "/home/{{ user }}/.ssh/config"
|
|
group: "{{ user }}"
|
|
owner: "{{ user }}"
|
|
mode: "0644"
|
|
|
|
- name: Check if ed25519 key exists
|
|
ansible.builtin.stat:
|
|
path: "/home/{{ user }}/.ssh/id_ed25519"
|
|
register: key_status
|
|
|
|
- name: No need to generate new ed25519 key
|
|
when: key_status.stat.exists
|
|
ansible.builtin.debug:
|
|
msg: No need to generate new ed25519 key as it already exists.
|
|
|
|
- name: Generate new id_ed25519 key
|
|
when: not key_status.stat.exists
|
|
become: true
|
|
become_user: "{{ user }}"
|
|
ansible.builtin.shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ inventory_hostname }} $(date '+%Y.%m.%d')" -N ""
|
|
changed_when: true
|