tanshu
97d6892c83
Two plays: bootstrap as the provider account (ubuntu, over bootstrap.pem), then everything else as the user that first play just created. The split is forced rather than stylistic -- the second play logs in as that user, so its authorized_keys entry and its NOPASSWD sudoers entry both have to exist before it starts. That is why the key tasks live in the 'user' role and 'wheel' runs in the first play: move either into play 2 and it fails with an auth error or "Missing sudo password". Both accounts and both keys are variables. The inventory sits beside the playbook and is read via ansible.cfg, which Ansible picks up from the current working directory rather than the playbook's, so it has to be run from this directory. bootstrap.pem is gitignored -- it is the provider key for the host.
23 lines
637 B
YAML
23 lines
637 B
YAML
---
|
|
- name: Ensure group wheel exists
|
|
ansible.builtin.group:
|
|
name: wheel
|
|
state: present
|
|
|
|
- name: Allow wheel group to have passwordless sudo
|
|
ansible.builtin.copy:
|
|
# A block scalar, so the file ends with a newline. With an inline string
|
|
# there is no trailing terminator and visudo rejects it with
|
|
# "syntax error: missing line terminator at end of file".
|
|
content: |
|
|
%wheel ALL=(ALL) NOPASSWD: ALL
|
|
dest: /etc/sudoers.d/wheel
|
|
mode: "0440"
|
|
validate: "/usr/sbin/visudo -cf %s"
|
|
|
|
- name: Adding user to group wheel
|
|
ansible.builtin.user:
|
|
name: "{{ user }}"
|
|
groups: wheel
|
|
append: true
|