tanshu
476a6d7cd0
Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
---
|
|
# Runs in the second play, after the user role has installed the keys this play logs in with.
|
|
|
|
- name: Update the sshd config file to disable password logins
|
|
ansible.builtin.replace:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "(\\s+)#PasswordAuthentication yes(\\s+.*)?$"
|
|
replace: "\\1PasswordAuthentication no\\2"
|
|
backup: true
|
|
|
|
- name: Check if .ssh config file exists
|
|
ansible.builtin.stat:
|
|
path: "/home/{{ user }}/.ssh/config"
|
|
register: config_status
|
|
|
|
- name: No need to upload the .ssh config
|
|
when: config_status.stat.exists
|
|
ansible.builtin.debug:
|
|
msg: No need to upload the .ssh config as it already exists.
|
|
|
|
- name: Upload the .ssh config file
|
|
when: not config_status.stat.exists
|
|
ansible.builtin.template:
|
|
src: "files/config"
|
|
dest: "/home/{{ user }}/.ssh/config"
|
|
group: "{{ user }}"
|
|
owner: "{{ user }}"
|
|
mode: "0644"
|
|
|
|
- name: Check if ed25519 key exists
|
|
ansible.builtin.stat:
|
|
path: "/home/{{ user }}/.ssh/id_ed25519"
|
|
register: key_status
|
|
|
|
- name: No need to generate new ed25519 key
|
|
when: key_status.stat.exists
|
|
ansible.builtin.debug:
|
|
msg: No need to generate new ed25519 key as it already exists.
|
|
|
|
- name: Generate new id_ed25519 key
|
|
when: not key_status.stat.exists
|
|
become: true
|
|
become_user: "{{ user }}"
|
|
ansible.builtin.shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ inventory_hostname }} $(date '+%Y.%m.%d')" -N ""
|
|
changed_when: true
|