tanshu
476a6d7cd0
Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.
71 lines
2.2 KiB
YAML
71 lines
2.2 KiB
YAML
---
|
|
# The zsh role owns the login shell, so this role must not set one.
|
|
|
|
- name: Create the desired user
|
|
ansible.builtin.user:
|
|
name: "{{ user }}"
|
|
create_home: true
|
|
state: present
|
|
|
|
- name: Ensure the user's SSH directory exists
|
|
ansible.builtin.file:
|
|
path: "/home/{{ user }}/.ssh"
|
|
state: directory
|
|
owner: "{{ user }}"
|
|
group: "{{ user }}"
|
|
mode: "0700"
|
|
|
|
- name: Ensure authorized_keys file exists
|
|
ansible.builtin.copy:
|
|
content: ""
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
force: false
|
|
owner: "{{ user }}"
|
|
group: "{{ user }}"
|
|
mode: "0644"
|
|
|
|
# The second play logs in with this key, so bootstrap installs it here rather
|
|
# than relying on a named key below. It uses lineinfile because authorized_key
|
|
# redirects to ansible.posix 2.1.0, which imports a deprecated helper and warns on every run.
|
|
- name: Authorize the control node's key for the new user
|
|
ansible.builtin.lineinfile:
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
line: "{{ lookup('file', user_key ~ '.pub') | trim }}"
|
|
create: true
|
|
owner: "{{ user }}"
|
|
group: "{{ user }}"
|
|
mode: "0644"
|
|
|
|
- name: Check Terminus public key
|
|
ansible.builtin.shell: "grep -c \"{{ terminus_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
|
|
register: terminuskey_test
|
|
changed_when: false
|
|
|
|
- name: Add Terminus public key
|
|
ansible.builtin.lineinfile:
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
line: "{{ terminus_key }}"
|
|
when: terminuskey_test.stdout == "0"
|
|
|
|
- name: Check clair public key
|
|
ansible.builtin.shell: "grep -c \"{{ clair_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
|
|
register: clairkey_test
|
|
changed_when: false
|
|
|
|
- name: Add clair public key
|
|
ansible.builtin.lineinfile:
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
line: "{{ clair_key }}"
|
|
when: clairkey_test.stdout == "0"
|
|
|
|
- name: Check Anjin public key
|
|
ansible.builtin.shell: "grep -c \"{{ anjin_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
|
|
register: anjin_key_test
|
|
changed_when: false
|
|
|
|
- name: Add Anjin public key
|
|
ansible.builtin.lineinfile:
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
line: "{{ anjin_key }}"
|
|
when: anjin_key_test.stdout == "0"
|