45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
---
|
|
- name: Install sudo before creating the admin account
|
|
ansible.builtin.apt:
|
|
name: sudo
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Ensure the sudo group exists
|
|
ansible.builtin.group:
|
|
name: "{{ admin_sudo_group }}"
|
|
state: present
|
|
|
|
- name: Create the admin account with a password for sudo
|
|
ansible.builtin.user:
|
|
name: "{{ admin_user }}"
|
|
comment: Server administrator
|
|
shell: "{{ admin_user_shell }}"
|
|
groups: "{{ admin_sudo_group }}"
|
|
append: true
|
|
create_home: true
|
|
password: "{{ admin_user_password_hash }}"
|
|
password_lock: false
|
|
update_password: always
|
|
state: present
|
|
no_log: true
|
|
|
|
- name: Require the admin account to enter its password for sudo
|
|
ansible.builtin.copy:
|
|
dest: "/etc/sudoers.d/90-{{ admin_user }}-password-required"
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
content: "{{ admin_user }} ALL=(ALL:ALL) PASSWD: ALL\n"
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Install the admin account's authorized SSH keys
|
|
ansible.posix.authorized_key:
|
|
user: "{{ admin_user }}"
|
|
key: "{{ item }}"
|
|
state: present
|
|
manage_dir: true
|
|
exclusive: false
|
|
loop: "{{ admin_user_authorized_keys }}"
|