dedicated ansible user and dedicated sssd playbook
This commit is contained in:
parent
9fe27b845c
commit
aed8122aba
@ -5,5 +5,5 @@ ldap_uri: "ldaps://ldap.ducamps.win"
|
||||
ldap_sudo_search_base: "ou=sudoers,dc=ducamps,dc=win"
|
||||
ldap_default_bind_dn : "uid=vaultserviceaccount,cn=users,dc=ducamps,dc=win"
|
||||
ldap_password : "{{lookup('hashi_vault', 'secret=secrets/data/ansible/other:vaulserviceaccount')}}"
|
||||
|
||||
userPassword: "{{lookup('hashi_vault', 'secret=secrets/data/ansible/user:userPassword')}}"
|
||||
|
||||
|
@ -3,10 +3,7 @@ requirements:
|
||||
ansible-galaxy install -g -r roles/requirements.yml
|
||||
|
||||
deploy_production:
|
||||
ansible-playbook site.yml -i production
|
||||
|
||||
deploy_staging:
|
||||
ansible-playbook site.yml -i staging
|
||||
ansible-playbook site.yml -i production -u ansible
|
||||
|
||||
generate-token:
|
||||
@echo export VAULT_TOKEN=`vault token create -policy=ansible -field="token" -period 6h`
|
||||
|
@ -25,7 +25,7 @@ platforms:
|
||||
provisioner:
|
||||
name: ansible
|
||||
connection_options:
|
||||
ansible_ssh_user: vincent
|
||||
ansible_ssh_user: ansible
|
||||
ansible_become: true
|
||||
env:
|
||||
ANSIBLE_CONFIG: ../../ansible.cfg
|
||||
|
23
ansible/playbooks/sssd.yml
Normal file
23
ansible/playbooks/sssd.yml
Normal file
@ -0,0 +1,23 @@
|
||||
---
|
||||
- hosts: all
|
||||
roles:
|
||||
- role: ansible-role-sssd
|
||||
become: True
|
||||
tasks:
|
||||
- name: simulate login
|
||||
stat:
|
||||
path: "/home/{{user.name}}"
|
||||
become: true
|
||||
become_user: "{{user.name}}"
|
||||
when: sssd_configure == true
|
||||
- name: create profil
|
||||
user:
|
||||
name: "{{user.name}}" # required. Name of the user to create, remove or modify.
|
||||
create_home: yes # not required. Unless set to C(no), a home directory will be made for the user when the account is created or if the home directory does not exist.,Changed from C(createhome) to C(create_home) in version 2.5.
|
||||
password: "{{userPassword}}" # not required. Optionally set the user's password to this crypted value.,On macOS systems, this value has to be cleartext. Beware of security issues.,See U(https://docs.ansible.com/ansible/faq.html#how-do-i-generate-crypted-passwords-for-the-user-module) for details on various ways to generate these password values.
|
||||
system: no # not required. When creating an account C(state=present), setting this to C(yes) makes the user a system account. This setting cannot be changed on existing users.
|
||||
state: present # not required. choices: absent;present. Whether the account should exist or not, taking action if the state is different from what is stated.
|
||||
ssh_key_file: .ssh/id_rsa # not required. Optionally specify the SSH key filename. If this is a relative filename then it will be relative to the user's home directory.
|
||||
uid: "{{ user.uid }}"
|
||||
shell: /bin/bash
|
||||
when: sssd_configure is not defined or sssd_configure == false
|
@ -1,4 +1,5 @@
|
||||
---
|
||||
- import_playbook: playbooks/sssd.yml
|
||||
- import_playbook: playbooks/server.yml
|
||||
- import_playbook: playbooks/wireguard.yml
|
||||
- import_playbook: playbooks/HashicorpStack.yml
|
||||
|
Loading…
Reference in New Issue
Block a user