From ab3bd183f52909f72c561824df5a60044e555883 Mon Sep 17 00:00:00 2001 From: Santiago Lo Coco Date: Fri, 12 Apr 2024 20:40:15 +0000 Subject: [PATCH] Add roles --- slococo/playground/LICENSE.md | 20 ++++++ slococo/playground/galaxy.yml | 61 +++---------------- slococo/playground/meta/runtime.yml | 52 +--------------- slococo/playground/plugins/README.md | 31 ---------- .../playground/roles/local_accounts/README.md | 29 ++++----- .../roles/local_accounts/defaults/main.yml | 2 +- .../roles/local_accounts/handlers/main.yml | 3 +- .../local_accounts/meta/argument_specs.yml | 38 ++++++++++++ .../roles/local_accounts/meta/main.yml | 55 ++--------------- .../roles/local_accounts/tasks/main.yml | 12 +++- .../roles/local_accounts/tests/test.yml | 21 ++++++- .../roles/local_accounts/vars/main.yml | 1 - slococo/playground/roles/ssh_config/README.md | 24 +++----- .../roles/ssh_config/defaults/main.yml | 5 +- .../roles/ssh_config/handlers/main.yml | 5 +- .../playground/roles/ssh_config/meta/main.yml | 54 +++------------- .../roles/ssh_config/tasks/main.yml | 16 ++++- .../roles/ssh_config/tests/inventory | 1 - .../roles/ssh_config/tests/test.yml | 9 ++- .../playground/roles/ssh_config/vars/main.yml | 1 - 20 files changed, 160 insertions(+), 280 deletions(-) create mode 100644 slococo/playground/LICENSE.md delete mode 100644 slococo/playground/plugins/README.md create mode 100644 slococo/playground/roles/local_accounts/meta/argument_specs.yml diff --git a/slococo/playground/LICENSE.md b/slococo/playground/LICENSE.md new file mode 100644 index 0000000..bf0d822 --- /dev/null +++ b/slococo/playground/LICENSE.md @@ -0,0 +1,20 @@ +The MIT License (MIT) + +Copyright (c) 2024 Santiago Lo Coco. + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/slococo/playground/galaxy.yml b/slococo/playground/galaxy.yml index 3e8f5d5..2453ab8 100644 --- a/slococo/playground/galaxy.yml +++ b/slococo/playground/galaxy.yml @@ -1,69 +1,22 @@ -### REQUIRED -# The namespace of the collection. This can be a company/brand/organization or product namespace under which all -# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with -# underscores or numbers and cannot contain consecutive underscores namespace: slococo - -# The name of the collection. Has the same character restrictions as 'namespace' name: playground - -# The version of the collection. Must be compatible with semantic versioning version: 1.0.0 - -# The path to the Markdown (.md) readme file. This path is relative to the root of the collection readme: README.md -# A list of the collection's content authors. Can be just the name or in the format 'Full Name (url) -# @nicks:irc/im.site#channel' authors: -- your name +- Santiago Lo Coco - -### OPTIONAL but strongly recommended -# A short summary description of the collection description: your collection description +license: MIT +license_file: LICENSE.md -# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only -# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file' -license: -- GPL-2.0-or-later - -# The path to the license file for the collection. This path is relative to the root of the collection. This key is -# mutually exclusive with 'license' -license_file: '' - -# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character -# requirements as 'namespace' and 'name' tags: [] - -# Collections that this collection requires to be installed for it to be usable. The key of the dict is the -# collection label 'namespace.name'. The value is a version range -# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version -# range specifiers can be set and are separated by ',' dependencies: {} -# The URL of the originating SCM repository -repository: http://example.com/repository - -# The URL to any online docs +repository: https://git.slc.ar/slococo/ansible-playground +documentation: https://git.slc.ar/slococo/ansible-playground +homepage: https://git.slc.ar/slococo/ansible-playground documentation: http://docs.example.com +issues: https://git.slc.ar/slococo/ansible-playground/issues -# The URL to the homepage of the collection/project -homepage: http://example.com - -# The URL to the collection issue tracker -issues: http://example.com/issue/tracker - -# A list of file glob-like patterns used to filter any files or directories that should not be included in the build -# artifact. A pattern is matched from the relative path of the file or directory of the collection directory. This -# uses 'fnmatch' to match the files or directories. Some directories and files like 'galaxy.yml', '*.pyc', '*.retry', -# and '.git' are always filtered. Mutually exclusive with 'manifest' build_ignore: [] - -# A dict controlling use of manifest directives used in building the collection artifact. The key 'directives' is a -# list of MANIFEST.in style -# L(directives,https://packaging.python.org/en/latest/guides/using-manifest-in/#manifest-in-commands). The key -# 'omit_default_directives' is a boolean that controls whether the default directives are used. Mutually exclusive -# with 'build_ignore' -# manifest: null - diff --git a/slococo/playground/meta/runtime.yml b/slococo/playground/meta/runtime.yml index 20f709e..898ad8f 100644 --- a/slococo/playground/meta/runtime.yml +++ b/slococo/playground/meta/runtime.yml @@ -1,52 +1,2 @@ --- -# Collections must specify a minimum required ansible version to upload -# to galaxy -# requires_ansible: '>=2.9.10' - -# Content that Ansible needs to load from another location or that has -# been deprecated/removed -# plugin_routing: -# action: -# redirected_plugin_name: -# redirect: ns.col.new_location -# deprecated_plugin_name: -# deprecation: -# removal_version: "4.0.0" -# warning_text: | -# See the porting guide on how to update your playbook to -# use ns.col.another_plugin instead. -# removed_plugin_name: -# tombstone: -# removal_version: "2.0.0" -# warning_text: | -# See the porting guide on how to update your playbook to -# use ns.col.another_plugin instead. -# become: -# cache: -# callback: -# cliconf: -# connection: -# doc_fragments: -# filter: -# httpapi: -# inventory: -# lookup: -# module_utils: -# modules: -# netconf: -# shell: -# strategy: -# terminal: -# test: -# vars: - -# Python import statements that Ansible needs to load from another location -# import_redirection: -# ansible_collections.ns.col.plugins.module_utils.old_location: -# redirect: ansible_collections.ns.col.plugins.module_utils.new_location - -# Groups of actions/modules that take a common set of options -# action_groups: -# group_name: -# - module1 -# - module2 +requires_ansible: '>=2.15.0' diff --git a/slococo/playground/plugins/README.md b/slococo/playground/plugins/README.md deleted file mode 100644 index 6260634..0000000 --- a/slococo/playground/plugins/README.md +++ /dev/null @@ -1,31 +0,0 @@ -# Collections Plugins Directory - -This directory can be used to ship various plugins inside an Ansible collection. Each plugin is placed in a folder that -is named after the type of plugin it is in. It can also include the `module_utils` and `modules` directory that -would contain module utils and modules respectively. - -Here is an example directory of the majority of plugins currently supported by Ansible: - -``` -└── plugins - ├── action - ├── become - ├── cache - ├── callback - ├── cliconf - ├── connection - ├── filter - ├── httpapi - ├── inventory - ├── lookup - ├── module_utils - ├── modules - ├── netconf - ├── shell - ├── strategy - ├── terminal - ├── test - └── vars -``` - -A full list of plugin types can be found at [Working With Plugins](https://docs.ansible.com/ansible-core/2.15/plugins/plugins.html). diff --git a/slococo/playground/roles/local_accounts/README.md b/slococo/playground/roles/local_accounts/README.md index 225dd44..8c30c32 100644 --- a/slococo/playground/roles/local_accounts/README.md +++ b/slococo/playground/roles/local_accounts/README.md @@ -1,38 +1,35 @@ Role Name ========= -A brief description of the role goes here. +Ansible Role to create local users... Requirements ------------ -Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. +... Role Variables -------------- -A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. +... -Dependencies ------------- - -A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. Example Playbook ---------------- -Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: - +```yaml - hosts: servers + vars: + local_users: + - name: test_user1 + shell: /bin/bash + userid: 1001 + roles: - - { role: username.rolename, x: 42 } + - { role: slococo.playground.local_accounts } +``` License ------- -BSD - -Author Information ------------------- - -An optional section for the role authors to include contact information, or a website (HTML is not allowed). +MIT diff --git a/slococo/playground/roles/local_accounts/defaults/main.yml b/slococo/playground/roles/local_accounts/defaults/main.yml index fe9d9de..26d8306 100644 --- a/slococo/playground/roles/local_accounts/defaults/main.yml +++ b/slococo/playground/roles/local_accounts/defaults/main.yml @@ -1,2 +1,2 @@ --- -# defaults file for local_accounts +local_users: [] \ No newline at end of file diff --git a/slococo/playground/roles/local_accounts/handlers/main.yml b/slococo/playground/roles/local_accounts/handlers/main.yml index fa18896..73b314f 100644 --- a/slococo/playground/roles/local_accounts/handlers/main.yml +++ b/slococo/playground/roles/local_accounts/handlers/main.yml @@ -1,2 +1 @@ ---- -# handlers file for local_accounts +--- \ No newline at end of file diff --git a/slococo/playground/roles/local_accounts/meta/argument_specs.yml b/slococo/playground/roles/local_accounts/meta/argument_specs.yml new file mode 100644 index 0000000..16dd729 --- /dev/null +++ b/slococo/playground/roles/local_accounts/meta/argument_specs.yml @@ -0,0 +1,38 @@ +--- +argument_specs: + main: + short_description: Ansible Role to create local users + options: + local_users: + type: list + required: true + elements: dict + description: List of dictionaries containing details of local users. + options: + name: + type: str + required: true + description: The username for the local user. + shell: + type: str + required: true + description: The shell for the local user. + userid: + type: int + required: true + description: The user ID for the local user. + expiry_date: + type: float + required: false + default: null + description: The expiry date for the local user (in epoch). + home: + type: path + required: false + default: "{{ '/home/' + name if name is defined else '' }}" + description: The home directory path for the local user. + groups: + type: list + required: false + default: "" + description: The primary group for the local user. \ No newline at end of file diff --git a/slococo/playground/roles/local_accounts/meta/main.yml b/slococo/playground/roles/local_accounts/meta/main.yml index c572acc..59c9a91 100644 --- a/slococo/playground/roles/local_accounts/meta/main.yml +++ b/slococo/playground/roles/local_accounts/meta/main.yml @@ -1,52 +1,9 @@ galaxy_info: - author: your name - description: your role description - company: your company (optional) - - # If the issue tracker for your role is not on github, uncomment the - # next line and provide a value - # issue_tracker_url: http://example.com/issue/tracker - - # Choose a valid license ID from https://spdx.org - some suggested licenses: - # - BSD-3-Clause (default) - # - MIT - # - GPL-2.0-or-later - # - GPL-3.0-only - # - Apache-2.0 - # - CC-BY-4.0 - license: license (GPL-2.0-or-later, MIT, etc) - - min_ansible_version: 2.1 - - # If this a Container Enabled role, provide the minimum Ansible Container version. - # min_ansible_container_version: - - # - # Provide a list of supported platforms, and for each platform a list of versions. - # If you don't wish to enumerate all versions for a particular platform, use 'all'. - # To view available platforms and versions (or releases), visit: - # https://galaxy.ansible.com/api/v1/platforms/ - # - # platforms: - # - name: Fedora - # versions: - # - all - # - 25 - # - name: SomePlatform - # versions: - # - all - # - 1.0 - # - 7 - # - 99.99 - - galaxy_tags: [] - # List tags for your role here, one per line. A tag is a keyword that describes - # and categorizes the role. Users find roles by searching for tags. Be sure to - # remove the '[]' above, if you add tags to this list. - # - # NOTE: A tag is limited to a single word comprised of alphanumeric characters. - # Maximum 20 tags per role. + author: Santiago Lo Coco + description: Ansible Role to create local users + company: cloudWerkstatt + license: MIT + min_ansible_version: 2.12.0 + galaxy_tags: ['users'] dependencies: [] - # List your role dependencies here, one per line. Be sure to remove the '[]' above, - # if you add dependencies to this list. diff --git a/slococo/playground/roles/local_accounts/tasks/main.yml b/slococo/playground/roles/local_accounts/tasks/main.yml index e178ce7..0ec9980 100644 --- a/slococo/playground/roles/local_accounts/tasks/main.yml +++ b/slococo/playground/roles/local_accounts/tasks/main.yml @@ -1,2 +1,12 @@ --- -# tasks file for local_accounts +- name: Create local user accounts + ansible.builtin.user: + name: "{{ item.name }}" + shell: "{{ item.shell }}" + uid: "{{ item.userid }}" + expires: "{{ item.expiry_date | default(omit) }}" + home: "{{ item.home | default(omit) }}" + groups: "{{ item.groups | default(omit) }}" + generate_ssh_key: yes + loop: "{{ local_users }}" + become: true diff --git a/slococo/playground/roles/local_accounts/tests/test.yml b/slococo/playground/roles/local_accounts/tests/test.yml index cc3ddbe..b6bed26 100644 --- a/slococo/playground/roles/local_accounts/tests/test.yml +++ b/slococo/playground/roles/local_accounts/tests/test.yml @@ -1,5 +1,20 @@ --- -- hosts: localhost - remote_user: root +- name: Test the local_accounts role + hosts: localhost + connection: local + gather_facts: no + + vars: + local_users: + - name: test_user1 + shell: /bin/bash + userid: 1001 + - name: test_user2 + shell: /bin/zsh + userid: 1002 + expiry_date: '1735689599' + home: /home/test_user3 + groups: docker + roles: - - local_accounts + - {role: ../..} diff --git a/slococo/playground/roles/local_accounts/vars/main.yml b/slococo/playground/roles/local_accounts/vars/main.yml index e0b863f..ed97d53 100644 --- a/slococo/playground/roles/local_accounts/vars/main.yml +++ b/slococo/playground/roles/local_accounts/vars/main.yml @@ -1,2 +1 @@ --- -# vars file for local_accounts diff --git a/slococo/playground/roles/ssh_config/README.md b/slococo/playground/roles/ssh_config/README.md index 225dd44..871d7b7 100644 --- a/slococo/playground/roles/ssh_config/README.md +++ b/slococo/playground/roles/ssh_config/README.md @@ -1,38 +1,30 @@ Role Name ========= -A brief description of the role goes here. +Ansible Role to check the SSH configuration... Requirements ------------ -Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. +... Role Variables -------------- -A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. +... -Dependencies ------------- - -A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. Example Playbook ---------------- -Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: - +```yaml - hosts: servers + roles: - - { role: username.rolename, x: 42 } + - { role: slococo.playground.ssh_config } +``` License ------- -BSD - -Author Information ------------------- - -An optional section for the role authors to include contact information, or a website (HTML is not allowed). +MIT diff --git a/slococo/playground/roles/ssh_config/defaults/main.yml b/slococo/playground/roles/ssh_config/defaults/main.yml index 1631aef..fa8276e 100644 --- a/slococo/playground/roles/ssh_config/defaults/main.yml +++ b/slococo/playground/roles/ssh_config/defaults/main.yml @@ -1,2 +1,5 @@ --- -# defaults file for ssh_config +sshd_options: + PasswordAuthentication: 'yes' + PermitEmptyPasswords: 'no' + PermitRootLogin: 'no' \ No newline at end of file diff --git a/slococo/playground/roles/ssh_config/handlers/main.yml b/slococo/playground/roles/ssh_config/handlers/main.yml index 1794c2c..dc0c18d 100644 --- a/slococo/playground/roles/ssh_config/handlers/main.yml +++ b/slococo/playground/roles/ssh_config/handlers/main.yml @@ -1,2 +1,5 @@ --- -# handlers file for ssh_config +- name: Restart SSH Service + ansible.builtin.service: + name: sshd + state: restarted \ No newline at end of file diff --git a/slococo/playground/roles/ssh_config/meta/main.yml b/slococo/playground/roles/ssh_config/meta/main.yml index c572acc..1654369 100644 --- a/slococo/playground/roles/ssh_config/meta/main.yml +++ b/slococo/playground/roles/ssh_config/meta/main.yml @@ -1,52 +1,12 @@ galaxy_info: - author: your name - description: your role description - company: your company (optional) + author: Santiago Lo Coco + description: Ansible Role to check SSH configuration + company: cloudWerkstatt - # If the issue tracker for your role is not on github, uncomment the - # next line and provide a value - # issue_tracker_url: http://example.com/issue/tracker + license: MIT - # Choose a valid license ID from https://spdx.org - some suggested licenses: - # - BSD-3-Clause (default) - # - MIT - # - GPL-2.0-or-later - # - GPL-3.0-only - # - Apache-2.0 - # - CC-BY-4.0 - license: license (GPL-2.0-or-later, MIT, etc) + min_ansible_version: 2.12.0 - min_ansible_version: 2.1 + galaxy_tags: ['ssh_config'] - # If this a Container Enabled role, provide the minimum Ansible Container version. - # min_ansible_container_version: - - # - # Provide a list of supported platforms, and for each platform a list of versions. - # If you don't wish to enumerate all versions for a particular platform, use 'all'. - # To view available platforms and versions (or releases), visit: - # https://galaxy.ansible.com/api/v1/platforms/ - # - # platforms: - # - name: Fedora - # versions: - # - all - # - 25 - # - name: SomePlatform - # versions: - # - all - # - 1.0 - # - 7 - # - 99.99 - - galaxy_tags: [] - # List tags for your role here, one per line. A tag is a keyword that describes - # and categorizes the role. Users find roles by searching for tags. Be sure to - # remove the '[]' above, if you add tags to this list. - # - # NOTE: A tag is limited to a single word comprised of alphanumeric characters. - # Maximum 20 tags per role. - -dependencies: [] - # List your role dependencies here, one per line. Be sure to remove the '[]' above, - # if you add dependencies to this list. +dependencies: [] \ No newline at end of file diff --git a/slococo/playground/roles/ssh_config/tasks/main.yml b/slococo/playground/roles/ssh_config/tasks/main.yml index 50d1257..32e8280 100644 --- a/slococo/playground/roles/ssh_config/tasks/main.yml +++ b/slococo/playground/roles/ssh_config/tasks/main.yml @@ -1,2 +1,16 @@ --- -# tasks file for ssh_config +- name: Check SSH daemon configuration + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: "[^#]{{ item.key }}.*" + line: "{{ item.key }} {{ item.value }}" + state: present + loop: "{{ sshd_options | dict2items }}" + register: sshd_config + become: true + +- name: Ensure SSH daemon configuration is consistent + ansible.builtin.command: sshd -t -f /etc/ssh/sshd_config + changed_when: sshd_config.changed + notify: Restart SSH Service + become: true diff --git a/slococo/playground/roles/ssh_config/tests/inventory b/slococo/playground/roles/ssh_config/tests/inventory index 878877b..2fbb50c 100644 --- a/slococo/playground/roles/ssh_config/tests/inventory +++ b/slococo/playground/roles/ssh_config/tests/inventory @@ -1,2 +1 @@ localhost - diff --git a/slococo/playground/roles/ssh_config/tests/test.yml b/slococo/playground/roles/ssh_config/tests/test.yml index 771d1da..389369e 100644 --- a/slococo/playground/roles/ssh_config/tests/test.yml +++ b/slococo/playground/roles/ssh_config/tests/test.yml @@ -1,5 +1,8 @@ --- -- hosts: localhost - remote_user: root +- name: Test the ssh_config role + hosts: localhost + connection: local + gather_facts: no + roles: - - ssh_config + - {role: ../..} \ No newline at end of file diff --git a/slococo/playground/roles/ssh_config/vars/main.yml b/slococo/playground/roles/ssh_config/vars/main.yml index 23e49be..ed97d53 100644 --- a/slococo/playground/roles/ssh_config/vars/main.yml +++ b/slococo/playground/roles/ssh_config/vars/main.yml @@ -1,2 +1 @@ --- -# vars file for ssh_config