38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
#################################################
|
|
# Prepare the server
|
|
#################################################
|
|
---
|
|
# A freshly provisioned host only has the provider's bootstrap account
|
|
# ({{ bootstrap_user }}). That account is used once, to create the real user
|
|
# and make it reachable and able to escalate. Everything after this play runs
|
|
# as {{ user }} instead.
|
|
- name: Bootstrap the new user
|
|
hosts: all
|
|
become: true
|
|
remote_user: "{{ bootstrap_user }}"
|
|
vars:
|
|
ansible_ssh_private_key_file: "{{ bootstrap_key }}"
|
|
vars_files:
|
|
- vars/default.yml
|
|
|
|
roles:
|
|
# Creates {{ user }} and installs its authorized_keys, so that the next
|
|
# play can log in as it.
|
|
- user
|
|
# Has to happen in this play too: the next play runs as {{ user }} with
|
|
# become, which needs the NOPASSWD sudoers entry this role writes.
|
|
- wheel
|
|
|
|
- name: Configure the server as the new user
|
|
hosts: all
|
|
become: true
|
|
remote_user: "{{ user }}"
|
|
vars:
|
|
ansible_ssh_private_key_file: "{{ user_key }}"
|
|
vars_files:
|
|
- vars/default.yml
|
|
|
|
roles:
|
|
- common
|
|
- zsh
|