tanshu
97d6892c83
Two plays: bootstrap as the provider account (ubuntu, over bootstrap.pem), then everything else as the user that first play just created. The split is forced rather than stylistic -- the second play logs in as that user, so its authorized_keys entry and its NOPASSWD sudoers entry both have to exist before it starts. That is why the key tasks live in the 'user' role and 'wheel' runs in the first play: move either into play 2 and it fails with an auth error or "Missing sudo password". Both accounts and both keys are variables. The inventory sits beside the playbook and is read via ansible.cfg, which Ansible picks up from the current working directory rather than the playbook's, so it has to be run from this directory. bootstrap.pem is gitignored -- it is the provider key for the host.
18 lines
636 B
Plaintext
18 lines
636 B
Plaintext
# Inventory for the prepare-server playbook.
|
|
#
|
|
# Ansible does not discover inventory files by name -- there is no convention
|
|
# that makes a file called "inventory" get read. It is used because ansible.cfg
|
|
# in this directory names it.
|
|
|
|
[servers]
|
|
# The alias must match `server` in vars/default.yml, and is what you pass to -l.
|
|
# No ansible_host is given because the control node's ~/.ssh/config already maps
|
|
# this name to an address. For a host that has no SSH config entry yet, give the
|
|
# address the provider handed you instead:
|
|
#
|
|
# fresh ansible_host=203.0.113.10
|
|
emily
|
|
|
|
[servers:vars]
|
|
ansible_python_interpreter=/usr/bin/python3
|