---
- name: 🛑 Fail if administrator authorized_keys is empty
ansible.builtin.fail:
msg: >-
lookup('users', '{{ USER_ADMINISTRATOR_NAME }}').authorized_keys must contain at least one SSH public key.
when: lookup('users', USER_ADMINISTRATOR_NAME).authorized_keys | length == 0
- name: 📂 Include dependency 'sys-sudo'
include_role:
name: sys-sudo
when: run_once_sys_sudo is not defined
- name: "🔎 Check whether {{ USER_ADMINISTRATOR_NAME }} already holds an SSH key"
ansible.builtin.stat:
path: "{{ DIR_HOME_ADMINISTRATOR }}.ssh/id_rsa"
register: user_administrator_ssh_key
- name: "📁 create {{ USER_ADMINISTRATOR_NAME }}"
user:
name: "{{ USER_ADMINISTRATOR_NAME }}"
update_password: on_create
password: "{{ lookup('users', USER_ADMINISTRATOR_NAME).password | password_hash('sha512') }}"
create_home: true
generate_ssh_key: "{{ not user_administrator_ssh_key.stat.exists }}"
ssh_key_type: rsa
ssh_key_bits: 8192
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🔧 set correct rights for {{ DIR_HOME_ADMINISTRATOR }}"
file:
path: "{{ DIR_HOME_ADMINISTRATOR }}"
state: directory
owner: "{{ USER_ADMINISTRATOR_NAME }}"
group: "{{ USER_ADMINISTRATOR_NAME }}"
mode: "0700"
- name: "🔐 grant {{ USER_ADMINISTRATOR_NAME }} sudo rights with password"
template: # nocheck: stack-host-template (per-host /etc/sudoers.d)
src: sudoers.j2
dest: "/etc/sudoers.d/{{ USER_ADMINISTRATOR_NAME }}"
mode: "0644"
owner: root
group: root
- name: "👤 embed user routines for {{ role_path | basename }}"
include_role:
name: user
vars:
user_key: "{{ IAM_HOST_ADMIN_USER_KEY }}"
- include_tasks: utils/once/flag.yml
