101 lines
2.5 KiB
YAML
101 lines
2.5 KiB
YAML
- name: Setup an alpine machine
|
|
hosts: homelab
|
|
user: root
|
|
vars:
|
|
# alpine_version: v3.19
|
|
alpine_version: latest-stable
|
|
robo:
|
|
authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILPiEGbVaaSJq/9hGaou3gd6m4Jzyj4AIgCL5wGTxVz1"
|
|
allowed_commands:
|
|
- "docker ps"
|
|
vars_files:
|
|
../../variables/secrets.yaml
|
|
tasks:
|
|
- name: Change login message
|
|
template:
|
|
src: ../../files/alpine/motd.j2
|
|
dest: /etc/motd
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
backup: yes
|
|
|
|
- name: Update repositories
|
|
template:
|
|
src: ../../files/alpine/repositories.j2
|
|
dest: /etc/apk/repositories
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
backup: yes
|
|
|
|
- name: Update all packages
|
|
command: /sbin/apk upgrade -U -a
|
|
|
|
- name: Be sure python is installed
|
|
command: /sbin/apk add python3
|
|
args:
|
|
creates: /usr/bin/python3
|
|
|
|
- name: Disable password authentication for SSH
|
|
become: true
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?PasswordAuthentication'
|
|
line: 'PasswordAuthentication no'
|
|
state: present
|
|
|
|
- name: Allow users of the weel group to use doas command
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/doas.conf
|
|
regexp: '^#\s*permit persist :wheel'
|
|
line: 'permit persist :wheel'
|
|
state: present
|
|
|
|
- name: Create a user group named docker
|
|
ansible.builtin.group:
|
|
name: docker
|
|
|
|
- name: Setup users
|
|
ansible.builtin.user:
|
|
state: present
|
|
name: aleidk
|
|
password: "{{ users.aleidk.password | password_hash('sha512') }}"
|
|
groups:
|
|
- wheel
|
|
- docker
|
|
|
|
- name: Create a user for executing remote commands
|
|
ansible.builtin.user:
|
|
name: robo
|
|
system: true
|
|
create_home: true
|
|
groups: nogroup
|
|
state: present
|
|
|
|
- name: Add SSH public key for robo user
|
|
ansible.posix.authorized_key:
|
|
user: robo
|
|
state: present
|
|
key: "{{ robo.authorized_key }}"
|
|
key_options: "command=\"{{ robo.allowed_commands | join('; ') }}\""
|
|
|
|
- name: Install packages
|
|
ansible.builtin.package:
|
|
state: present
|
|
name:
|
|
- docker
|
|
|
|
- name: Start docker service
|
|
ansible.builtin.service:
|
|
name: docker
|
|
state: started
|
|
enabled: true
|
|
|
|
handlers:
|
|
- name: Restart sshd
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: restarted
|