Refactor Ansible tasks to use fully qualified module names and improve code consistency
- Updated all tasks to use fully qualified module names (e.g., ansible.builtin.shell, ansible.builtin.copy) for clarity and to avoid ambiguity. - Replaced deprecated 'yum' module with 'dnf' for package management on RedHat-based systems. - Improved formatting and consistency in task definitions, including the use of double quotes for strings and consistent indentation. - Removed unnecessary comments and whitespace to enhance readability. - Ensured that conditions and loops are consistently formatted across all tasks.
This commit is contained in:
@@ -1,5 +1,4 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Set base home directory
|
||||
# ---
|
||||
@@ -7,8 +6,8 @@
|
||||
- name: HOME in /etc/default/useradd setzen oder hinter Kommentar einfügen
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/default/useradd
|
||||
regexp: '^HOME='
|
||||
insertafter: '^#\s*HOME='
|
||||
regexp: "^HOME="
|
||||
insertafter: "^#\\s*HOME="
|
||||
line: "HOME={{ base_home }}"
|
||||
backup: true
|
||||
when:
|
||||
@@ -18,43 +17,43 @@
|
||||
- name: DHOME in /etc/adduser.conf setzen oder hinter Kommentar einfügen
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/adduser.conf
|
||||
regexp: '^DHOME='
|
||||
insertafter: '^#\s*DHOME='
|
||||
regexp: "^DHOME="
|
||||
insertafter: "^#\\s*DHOME="
|
||||
line: "DHOME={{ base_home }}"
|
||||
backup: true
|
||||
when:
|
||||
- base_home is defined
|
||||
- base_home != '/home'
|
||||
- base_home is defined
|
||||
- base_home != '/home'
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (users.yml) Ensure default groups exists
|
||||
group:
|
||||
name: '{{ item.name }}'
|
||||
ansible.builtin.group:
|
||||
name: "{{ item.name }}"
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
gid: "{{ item.group_id | default(omit) }}"
|
||||
loop: "{{ default_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when: item.group_id is defined
|
||||
tags:
|
||||
- groups-exists
|
||||
|
||||
- name: (users.yml) Ensure default users exists
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.name }}"
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
group: '{{ item.group | default(omit) }}'
|
||||
uid: "{{ item.user_id | default(omit) }}"
|
||||
group: "{{ item.group | default(omit) }}"
|
||||
home: "{{ item.home | default('/home/' ~ item.name) }}"
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
shell: '{{ item.shell | d("/bin/bash") }}'
|
||||
password: "{{ item.password }}"
|
||||
update_password: on_create
|
||||
loop: "{{ default_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when: item.name != ansible_user
|
||||
tags:
|
||||
- users-exists
|
||||
@@ -65,7 +64,7 @@
|
||||
key: "{{ item.1 }}"
|
||||
state: present
|
||||
with_subelements:
|
||||
- '{{ default_user }}'
|
||||
- "{{ default_user }}"
|
||||
- ssh_keys
|
||||
loop_control:
|
||||
label: "{{ item.0.name }}"
|
||||
@@ -77,31 +76,31 @@
|
||||
# ---
|
||||
|
||||
- name: (users.yml) Ensure extra groups exists
|
||||
group:
|
||||
name: '{{ item.name }}'
|
||||
ansible.builtin.group:
|
||||
name: "{{ item.name }}"
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
gid: "{{ item.group_id | default(omit) }}"
|
||||
loop: "{{ extra_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
label: "{{ item.name }}"
|
||||
when:
|
||||
- extra_user is defined and extra_user|length > 0
|
||||
tags:
|
||||
- groups-exists
|
||||
|
||||
- name: (users.yml) Ensure extra users exists
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.name }}"
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
group: '{{ item.name | default(omit) }}'
|
||||
home: '{{ item.home | default(omit) }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
uid: "{{ item.user_id | default(omit) }}"
|
||||
group: "{{ item.name | default(omit) }}"
|
||||
home: "{{ item.home | default(omit) }}"
|
||||
shell: '{{ item.shell | d("/bin/bash") }}'
|
||||
password: "{{ item.password }}"
|
||||
update_password: on_create
|
||||
loop: "{{ extra_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when: extra_user is defined and extra_user|length > 0
|
||||
tags:
|
||||
- users-exists
|
||||
@@ -112,7 +111,7 @@
|
||||
key: "{{ item.1 }}"
|
||||
state: present
|
||||
with_subelements:
|
||||
- '{{ extra_user }}'
|
||||
- "{{ extra_user }}"
|
||||
- ssh_keys
|
||||
loop_control:
|
||||
label: "{{ item.0.name }}"
|
||||
@@ -129,20 +128,19 @@
|
||||
loop_control:
|
||||
label: "{{ item.user }}"
|
||||
when:
|
||||
- entries_authorized_key is defined
|
||||
- entries_authorized_key|length > 0
|
||||
|
||||
- entries_authorized_key is defined
|
||||
- entries_authorized_key|length > 0
|
||||
|
||||
# ---
|
||||
# - extra system groups
|
||||
# ---
|
||||
|
||||
- name: (users.yml) Extra system group sftp_users
|
||||
group:
|
||||
name: 'sftp_users'
|
||||
ansible.builtin.group:
|
||||
name: "sftp_users"
|
||||
state: present
|
||||
system: yes
|
||||
when:
|
||||
system: true
|
||||
when:
|
||||
- create_sftp_group is defined and create_sftp_group > 0
|
||||
tags:
|
||||
- groups-exists
|
||||
@@ -152,21 +150,20 @@
|
||||
# ---
|
||||
|
||||
- name: (users.yml) extra system user exists?
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
ansible.builtin.user:
|
||||
name: "{{ item.name }}"
|
||||
state: present
|
||||
system: yes
|
||||
home: '{{ item.home }}'
|
||||
shell: '{{ item.shell|d("/usr/sbin/nologin") }}'
|
||||
groups: '{{ item.groups | default(omit) }}'
|
||||
system: true
|
||||
home: "{{ item.home }}"
|
||||
shell: '{{ item.shell | d("/usr/sbin/nologin") }}'
|
||||
groups: "{{ item.groups | default(omit) }}"
|
||||
loop: "{{ extra_system_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when: extra_system_user is defined and extra_system_user|length > 0
|
||||
tags:
|
||||
- user-exists
|
||||
|
||||
|
||||
# ---
|
||||
# - Take care backup host has rsa key to connect via ssh to the other hosts
|
||||
# ---
|
||||
@@ -224,47 +221,46 @@
|
||||
# - authorized_key
|
||||
# - keypair-backup-server
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow connection via ssh to backup host
|
||||
# ---
|
||||
|
||||
- name: Ensure root's .ssh directory exists
|
||||
file:
|
||||
ansible.builtin.file:
|
||||
path: /root/.ssh
|
||||
state: directory
|
||||
|
||||
- name: (users.yml) Copy (backup) ed25519 ssh private key to user root
|
||||
copy:
|
||||
src: '{{ item.priv_key_src }}'
|
||||
dest: '{{ item.priv_key_dest }}'
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.priv_key_src }}"
|
||||
dest: "{{ item.priv_key_dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
when:
|
||||
mode: "0600"
|
||||
when:
|
||||
- insert_keypair_backup_client|bool
|
||||
- ssh_keypair_backup_client is defined
|
||||
- ssh_keypair_backup_client|length > 0
|
||||
loop: "{{ ssh_keypair_backup_client }}"
|
||||
loop_control:
|
||||
label: 'dest: {{ item.priv_key_dest }}'
|
||||
label: "dest: {{ item.priv_key_dest }}"
|
||||
tags:
|
||||
- insert_ssh_keypair_backup_server
|
||||
|
||||
- name: (users.yml) Copy (backup) ed25519 ssh public key to user root
|
||||
copy:
|
||||
src: '{{ item.pub_key_src }}'
|
||||
dest: '{{ item.pub_key_dest }}'
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.pub_key_src }}"
|
||||
dest: "{{ item.pub_key_dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
when:
|
||||
mode: "0644"
|
||||
when:
|
||||
- insert_keypair_backup_client|bool
|
||||
- ssh_keypair_backup_client is defined
|
||||
- ssh_keypair_backup_client|length > 0
|
||||
loop: "{{ ssh_keypair_backup_client }}"
|
||||
loop_control:
|
||||
label: 'dest: {{ item.pub_key_dest }}'
|
||||
label: "dest: {{ item.pub_key_dest }}"
|
||||
tags:
|
||||
- insert_ssh_keypair_backup_server
|
||||
|
||||
@@ -275,7 +271,7 @@
|
||||
state: present
|
||||
loop: "{{ ssh_keypair_backup_client }}"
|
||||
loop_control:
|
||||
label: 'authorized_keys - user: root'
|
||||
label: "authorized_keys - user: root"
|
||||
when:
|
||||
- inventory_hostname == item.target
|
||||
- ssh_keypair_backup_client is defined
|
||||
@@ -284,18 +280,17 @@
|
||||
- authorized_key
|
||||
- ssh-keypair-backup-server
|
||||
|
||||
|
||||
- name: (users.yml) Copy further ssh private key(s) to user root
|
||||
copy:
|
||||
src: '{{ item.priv_key_src }}'
|
||||
dest: '{{ item.priv_key_dest }}'
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.priv_key_src }}"
|
||||
dest: "{{ item.priv_key_dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
mode: "0600"
|
||||
loop: "{{ root_ssh_keypair }}"
|
||||
loop_control:
|
||||
label: 'dest: {{ item.priv_key_dest }}'
|
||||
when:
|
||||
label: "dest: {{ item.priv_key_dest }}"
|
||||
when:
|
||||
- insert_root_ssh_keypair|bool
|
||||
- root_ssh_keypair is defined
|
||||
- root_ssh_keypair|length > 0
|
||||
@@ -304,20 +299,19 @@
|
||||
- root-defaut-ssh-keypair
|
||||
|
||||
- name: (users.yml) Copy further ssh public key(s) to user root
|
||||
copy:
|
||||
src: '{{ item.pub_key_src }}'
|
||||
dest: '{{ item.pub_key_dest }}'
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.pub_key_src }}"
|
||||
dest: "{{ item.pub_key_dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
mode: "0644"
|
||||
loop: "{{ root_ssh_keypair }}"
|
||||
loop_control:
|
||||
label: 'dest: {{ item.pub_key_dest }}'
|
||||
when:
|
||||
label: "dest: {{ item.pub_key_dest }}"
|
||||
when:
|
||||
- insert_root_ssh_keypair|bool
|
||||
- root_ssh_keypair is defined
|
||||
- root_ssh_keypair|length > 0
|
||||
tags:
|
||||
- insert_root_ssh_keypair
|
||||
- root-defaut-ssh-keypair
|
||||
|
||||
|
||||
Reference in New Issue
Block a user