Kapisi/roles/basics/tasks/main.yml

121 lines
3.3 KiB
YAML
Raw Normal View History

2020-10-08 16:33:19 -05:00
---
###
# This role installs the basic package and host setup for AniNIX operations.
#
#
#
- name: Set up AniNIX-specific repository
become: yes
file:
path: /opt/aninix
state: directory
- name: Verify GPG keys
ignore_errors: yes
become: yes
command:
cmd: gpg --homedir /etc/pacman.d/gnupg --list-key 1CC1E3F4ED06F296
register: gpg_verify
when: ansible_os_family == "Archlinux"
- name: Install GPG keys
become: yes
command:
cmd: /bin/bash -l -c 'pacman-key --recv-key 1CC1E3F4ED06F296; pacman-key --finger 1CC1E3F4ED06F296; pacman-key --lsign-key 1CC1E3F4ED06F296;'
when: ansible_os_family == "Archlinux" and gpg_verify.rc != 0
- name: Set up pacman.conf
become: yes
blockinfile:
path: /etc/pacman.conf
insertafter: EOF
marker: "# {mark} Ubiqtorate Managed Block"
block: |
[AniNIX]
SigLevel = Required DatabaseOptional
Server = https://maat.aninix.net/
[aur]
SigLevel = Required DatabaseOptional
Server = https://maat.aninix.net/aur/
when: ansible_os_family == "Archlinux"
- name: Install ShadowArch (ArchLinux)
become: yes
pacman:
name: ShadowArch
state: present
update_cache: yes
when: ansible_os_family == "Archlinux"
- name: Download ShadowArch (Other)
become: yes
git:
repo: 'https://foundation.aninix.net/AniNIX/ShadowArch'
dest: '/opt/aninix/ShadowArch'
update: yes
when: ansible_os_family != "Archlinux"
- name: Install ShadowArch (Other)
become: yes
command:
chdir: '/opt/aninix/ShadowArch'
cmd: 'make install'
when: ansible_os_family != "Archlinux"
- name: Base packages
become: yes
package:
name:
- bash
- sudo
- name: Set up hostname
become: yes
hostname:
name: "{{ inventory_hostname }}.{{ replica_domain }}"
- name: Set up /etc/hosts
become: yes
lineinfile:
dest: /etc/hosts
regexp: '^127.0.0.1[ \t]+localhost'
line: "127.0.0.1 localhost localhost.localdomain {{ inventory_hostname }} {{ inventory_hostname }}.{{ replica_domain }}"
state: present
# This is an AniNIX convention to allow password management by Ansible.
2020-10-18 23:49:25 -05:00
- name: Ensure SSH user has sudo permissions.
2020-10-08 16:33:19 -05:00
become: yes
copy:
2020-10-18 23:49:25 -05:00
dest: /etc/sudoers.d/basics
content: "{{ lookup('env','USER') }} ALL=(ALL) NOPASSWD: ALL\n"
# Remove unneeded file
- file:
path: /etc/sudoers.d/1001
state: absent
become: yes
2020-10-08 16:33:19 -05:00
- name: Test root password
ignore_errors: yes
register: root_password_test
become: yes
command: id
vars:
ansible_become_method: su
ansible_become_user: root
ansible_become_password: "{{ lookup('vars',inventory_hostname+'_password') }}"
- name: Define root password
become: yes
when: root_password_test.rc is not defined or root_password_test.rc != 0
command:
cmd: /bin/bash -l -c "printf '%s\n%s\n' '{{ lookup('vars',inventory_hostname+'_password') }}' '{{ lookup('vars',inventory_hostname+'_password') }}' | passwd"
- name: Define depriv password
become: yes
when: root_password_test.rc is not defined or root_password_test.rc != 0
command:
cmd: /bin/bash -l -c "printf '%s\n%s\n' '{{ lookup('vars',inventory_hostname+'_password') }}' '{{ lookup('vars',inventory_hostname+'_password') }}' | passwd {{ depriv_user.stdout }}"