0bb4232586
We want to launch a new bastion host to run ansible on. Because we're working on the transition to ansible, it seems like being able to do that without needing puppet would be nice. This gets user management, base repo setup and whatnot installed. It doesn't remove them from the existing puppet, nor does it change the way we're calling anything that currently exists. Add bridge.openstack.org to the disabled group so that we don't try to run puppet on it. Change-Id: I3165423753009c639d9d2e2ed7d9adbe70360932
50 lines
1.1 KiB
YAML
50 lines
1.1 KiB
YAML
- name: Setup login.defs file
|
|
copy:
|
|
dest: /etc/login.defs
|
|
src: '{{ ansible_facts.os_family }}/login.defs'
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- name: Delete old users
|
|
loop: "{{ disabled_users }}"
|
|
user:
|
|
name: "{{ item }}"
|
|
state: absent
|
|
remove: yes
|
|
|
|
- name: Add groups
|
|
loop: "{{ base_users + extra_users }}"
|
|
group:
|
|
name: "{{ item }}"
|
|
state: present
|
|
gid: "{{ all_users[item].gid|default(omit) }}"
|
|
when:
|
|
- item in all_users
|
|
- "'gid' in all_users[item]"
|
|
|
|
- name: Add users
|
|
loop: "{{ base_users + extra_users }}"
|
|
user:
|
|
name: "{{ item }}"
|
|
state: present
|
|
uid: "{{ all_users[item].uid }}"
|
|
group: "{{ item }}"
|
|
comment: "{{ all_users[item].comment }}"
|
|
groups: admin,sudo
|
|
shell: /bin/bash
|
|
when:
|
|
- item in all_users
|
|
- "'uid' in all_users[item]"
|
|
|
|
- name: Add ssh keys to users
|
|
loop: "{{ base_users + extra_users }}"
|
|
authorized_key:
|
|
user: "{{ item }}"
|
|
state: present
|
|
key: "{{ all_users[item].key }}"
|
|
exclusive: yes
|
|
when:
|
|
- item in all_users
|
|
- "'key' in all_users[item]"
|