fix: update bot user permissions

playbooks/setup/alpine.yaml

@@ -4,15 +4,15 @@
 - name: Setup an alpine machine
   hosts: homelab
   user: root
+  vars_files:
+    ../../variables/secrets.yaml
   vars:
     # alpine_version: v3.19
     alpine_version: latest-stable
     robo:
-      authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILPiEGbVaaSJq/9hGaou3gd6m4Jzyj4AIgCL5wGTxVz1"
+      authorized_key: "{{ users.robo.ssh_keys.pub }}"
       allowed_commands:
-        - "docker ps"
+        - "docker system dial-stdio"
-  vars_files:
-    ../../variables/secrets.yaml
   tasks:
     - name: Change login message
       template:
@@ -49,6 +49,15 @@
         line: 'PasswordAuthentication no'
         state: present
 
+    - name: Disable password authentication for SSH
+      become: true
+      notify: Restart sshd
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PubkeyAuthentication'
+        line: 'PubkeyAuthentication yes'
+        state: present
+
     - name: Allow users of the weel group to use doas command
       become: true
       ansible.builtin.lineinfile:
@@ -74,14 +83,19 @@
       ansible.builtin.user:
         name: robo
         system: true
+        shell: /bin/sh
+        password: "*"
         create_home: true
-        groups: nogroup
+        groups:
+          - nogroup
+          - docker
         state: present
 
     - name: Add SSH public key for robo user
       ansible.posix.authorized_key:
         user: robo
         state: present
+        exclusive: true
         key: "{{ robo.authorized_key }}"
         key_options: "command=\"{{ robo.allowed_commands | join('; ') }}\""
 

variables/secrets.yaml

@@ -1,9 +1,38 @@
 $ANSIBLE_VAULT;1.1;AES256
-62343433336464323761613330643861353862393130383631306536366639323233663233623735
+66623439343462353362333136383366613962326637633939663437333434653031363666353239
-3131393037626664333235623764353939613835313030330a346133636334323132623536663830
+6465366633663063613732393039383732663134333163300a336538633965623330386434636262
-65386432383562343738333137386564653963396537653435613566326463356131316437393537
+61336130363830623439663262346433663361393830613933386233363730363264346264323531
-3239353134323261340a306234393263383331396430396666376337343161313232396566343933
+3937666332333834630a346437396634316435656631616632616632393362343439643162393832
-39356161346439663764663763346666653933316537306336383339626136326639343564613231
+63633366386564623433396135633938653864386230373331333931626166303837386464353637
-34343730326166356433336266643532393037653363356334383630646335313162366237343234
+32343231313664626131653635396334613533666132643661633865323031366262646438643964
-34353933383365636662343364303366633662316430646536323861356163383039346234663239
+66396338336436326432333966633832303831323439303733356266363437323735363064396531
-62376366373864373336
+34303264343166336532333237633563623763636637613131663138653933373362376561383539
+37373534393931326537393761616162643038386536326661666530303930393237366334393434
+39333335363363343134396337363365346336343033323063316438303835316532623961636135
+64383932643334643031353333346465373861626131336464666566663136336166346438653237
+39363563356262303036386333366665343539363161363764656262646230396436623761663437
+63396265643037663366643239616161386338386363333632376163633464336534306435383839
+39326136363765323831316137386264333162396538343562633336626633363834653031636364
+65393833613737656631363936646664393464376566343961316562663264633763616532666338
+35303234633036343437346334333837616230346565633163323838663539363237633537393461
+30633634353233613064643562323034633134616463393937393234366565626337613766303634
+37663164613833326364643263383564396462626132323032353036306134343863323935363631
+32383232396339363732333831393563346431663639323861613935303531383961663562656463
+30616435643764666639306264636336386163316632613235666561376131656538376532323064
+65373362656636346435373639663436383034656362336439386533396539613633666466663661
+64363734353338336562666234636135376238303966613833363966656566346531666535396433
+33613765656639336131376232323133303764616461623065393365613933656236646238353062
+33393137653535333637343733306439366630633438323638353531326638333465313235656233
+39383834383964393638663664646638333766363964653336626536613437373439303463393330
+63306463376265323062363637333539386236386437643064653432356130346131626335396466
+39303835636638393433633339306463366531313766323035653462373363373064663634356538
+39386333303335353161343631346637343634653932316465363832353031333761353761303162
+38356439363630666662366266663862333333646563396664326530393162633764373866343866
+36383239653531393264313430636564376131373938623861636662393635316634333064336336
+38636666396562643236303239306332393532656534666233353630666235376162353436373033
+62663962663937313530613165653434326235323262326136303863303836326232613938356538
+32336661336235666163306263333464366531616432303163393565326137623562306264666335
+37353039373766653264656666663363336362613933326437633833393961386134313363363431
+38653036636164346138666332613837396561333561313535306232366437303838383938326331
+63373037363036386664363164613735663663626231653366666161383665386336666530383465
+65353162383835643266623762633235363465623764326435303831343730353562