tanshu
476a6d7cd0
Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.
97 lines
2.8 KiB
YAML
97 lines
2.8 KiB
YAML
---
|
|
# Git-over-SSH uses the host's sshd on port 22, and the shim reaches the container through a one-command sudoers rule.
|
|
- name: Ensure the git group exists
|
|
ansible.builtin.group:
|
|
name: "{{ git_user }}"
|
|
become: true
|
|
|
|
# sshd runs the forced command through the login user's shell, so it must not be nologin; the uid is left to the system.
|
|
- name: Add the git login user
|
|
ansible.builtin.user:
|
|
name: "{{ git_user }}"
|
|
comment: Gitea SSH login user
|
|
group: "{{ git_user }}"
|
|
home: "{{ git_home }}"
|
|
shell: /bin/bash
|
|
create_home: true
|
|
become: true
|
|
|
|
|
|
- name: Install the git-over-SSH passthrough shim
|
|
ansible.builtin.template:
|
|
src: gitea.j2
|
|
dest: "{{ shim_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
become: true
|
|
|
|
- name: Install the container exec wrapper
|
|
ansible.builtin.template:
|
|
src: gitea-container-exec.j2
|
|
dest: "{{ podman_exec_wrapper }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
become: true
|
|
|
|
- name: Install the authorized_keys hook sshd runs for the git user
|
|
ansible.builtin.template:
|
|
src: gitea-authorized-keys.j2
|
|
dest: "{{ authorized_keys_command }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
become: true
|
|
|
|
# A syntax error in /etc/sudoers.d breaks every sudo on the host, so validate before installing.
|
|
- name: Let the git user reach the container as {{ podman_user }}
|
|
ansible.builtin.template:
|
|
src: sudoers-gitea.j2
|
|
dest: "{{ sudoers_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: /usr/sbin/visudo -cf %s
|
|
become: true
|
|
|
|
- name: Point sshd at Gitea's authorized_keys
|
|
block:
|
|
- name: Install the sshd drop-in for the git user
|
|
ansible.builtin.template:
|
|
src: sshd-gitea.conf.j2
|
|
dest: "{{ sshd_dropin_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: gitea_sshd_dropin
|
|
become: true
|
|
|
|
# A drop-in that does not parse locks everyone out on the next reboot, so validate it and remove the file if it fails.
|
|
- name: Validate the resulting sshd configuration
|
|
ansible.builtin.command: /usr/sbin/sshd -t
|
|
changed_when: false
|
|
become: true
|
|
when: gitea_sshd_dropin.changed
|
|
rescue:
|
|
- name: Take the sshd drop-in back out
|
|
ansible.builtin.file:
|
|
path: "{{ sshd_dropin_path }}"
|
|
state: absent
|
|
become: true
|
|
|
|
- name: Fail
|
|
ansible.builtin.fail:
|
|
msg: >-
|
|
{{ sshd_dropin_path }} did not validate, so it has been removed and
|
|
sshd is still running — and still restarting — on its previous
|
|
configuration. Run `/usr/sbin/sshd -t` on the host to see why.
|
|
|
|
# A reload re-execs sshd without dropping the connection this play runs over.
|
|
- name: Reload sshd
|
|
ansible.builtin.systemd_service:
|
|
name: "{{ sshd_service }}"
|
|
state: reloaded
|
|
become: true
|
|
when: gitea_sshd_dropin.changed
|