105 lines
No EOL
3.8 KiB
YAML
105 lines
No EOL
3.8 KiB
YAML
---
|
|
# Phase 2: System Configuration
|
|
# See ../../../tasks/TASK-phase2-3.md for full scope and reasoning.
|
|
#
|
|
# Runs using the kickstart's temporary NOPASSWD bootstrap grant
|
|
# (/etc/sudoers.d/00-bootstrap-<user>) — this task's own job is to
|
|
# replace that grant with something deliberate, not to assume it's
|
|
# permanent.
|
|
|
|
- name: Confirm bootstrap sudoers file exists (sanity check before removing it)
|
|
ansible.builtin.stat:
|
|
path: "/etc/sudoers.d/00-bootstrap-{{ bigboy_admin_user }}"
|
|
register: bootstrap_sudoers
|
|
|
|
- name: Deploy real sudoers policy (NOPASSWD retained — Ansible needs unattended escalation for future phases)
|
|
ansible.builtin.copy:
|
|
dest: "/etc/sudoers.d/10-admin"
|
|
content: |
|
|
# Real, deliberate sudoers policy for {{ bigboy_admin_user }}.
|
|
# Supersedes the kickstart's temporary bootstrap grant
|
|
# (00-bootstrap-{{ bigboy_admin_user }}), which this same task
|
|
# removes below.
|
|
#
|
|
# NOPASSWD retained deliberately: Ansible needs unattended
|
|
# privilege escalation to run subsequent phases without
|
|
# prompting. This is a considered choice, not a leftover — if a
|
|
# scoped-down policy (password-required, or command-restricted)
|
|
# is wanted instead, that's a decision to revisit explicitly,
|
|
# not something this task silently assumed.
|
|
{{ bigboy_admin_user }} ALL=(ALL) NOPASSWD: ALL
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
validate: "visudo -cf %s"
|
|
|
|
- name: Remove the kickstart's temporary bootstrap sudoers grant
|
|
ansible.builtin.file:
|
|
path: "/etc/sudoers.d/00-bootstrap-{{ bigboy_admin_user }}"
|
|
state: absent
|
|
when: bootstrap_sudoers.stat.exists
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# SSH key deployment — single key only, this phase (see task doc for why:
|
|
# BigBoy sits on the isolated bench LAN right now, no other devices present
|
|
# to test additional keys against yet).
|
|
# ---------------------------------------------------------------------------
|
|
|
|
- name: Deploy workbench's SSH public key
|
|
ansible.posix.authorized_key:
|
|
user: "{{ bigboy_admin_user }}"
|
|
state: present
|
|
key: "{{ lookup('file', 'keys/workbench.pub') }}"
|
|
|
|
# Explicitly not disabling PasswordAuthentication here — that's Phase 9's
|
|
# job, once key-based login is confirmed working over real, repeated use,
|
|
# not assumed the moment this task deploys a key.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Base system confirmation
|
|
# ---------------------------------------------------------------------------
|
|
|
|
- name: Confirm hostname
|
|
ansible.builtin.command: hostname
|
|
register: hostname_check
|
|
changed_when: false
|
|
|
|
- name: Fail if hostname doesn't match expected
|
|
ansible.builtin.fail:
|
|
msg: "Hostname is '{{ hostname_check.stdout }}', expected 'bigboy'"
|
|
when: hostname_check.stdout != 'bigboy'
|
|
|
|
- name: Confirm timezone
|
|
ansible.builtin.command: timedatectl show --property=Timezone --value
|
|
register: timezone_check
|
|
changed_when: false
|
|
|
|
- name: Fail if timezone doesn't match expected
|
|
ansible.builtin.fail:
|
|
msg: "Timezone is '{{ timezone_check.stdout }}', expected 'Europe/Rome'"
|
|
when: timezone_check.stdout != 'Europe/Rome'
|
|
|
|
- name: Confirm chrony is active (NTP sync)
|
|
ansible.builtin.systemd:
|
|
name: chronyd
|
|
register: chrony_status
|
|
|
|
- name: Fail if chrony isn't running
|
|
ansible.builtin.fail:
|
|
msg: "chronyd is not active — NTP sync not confirmed"
|
|
when: chrony_status.status.ActiveState != 'active'
|
|
|
|
- name: Confirm all four expected repos are enabled
|
|
ansible.builtin.command: dnf repolist enabled
|
|
register: repolist_check
|
|
changed_when: false
|
|
|
|
- name: Fail if any expected repo is missing
|
|
ansible.builtin.fail:
|
|
msg: "Expected repo '{{ item }}' not found in enabled repolist"
|
|
loop:
|
|
- baseos
|
|
- appstream
|
|
- crb
|
|
- extras
|
|
when: item not in repolist_check.stdout |