prepare.yml #2

---
# Prepare the container before the role runs.
# The role does NOT create the SDP volume directories (real deployments mount
# them as EBS/NFS/etc.), so create them here, and make sure the base utilities
# the role + p4d need are present.
- name: Prepare
  hosts: all
  become: true
  tasks:
    - name: "Create the SDP volume directories (role assumes they already exist)"
      ansible.builtin.file:
        path: "/{{ item }}"
        state: directory
        mode: '0755'
      loop:
        - hxdepots
        - hxlogs
        - hxmetadata

    - name: "Refresh the apt cache (Debian images ship without one)"
      ansible.builtin.apt:
        update_cache: true
      when: ansible_facts['os_family'] == 'Debian'

    # The EL9 image's nsswitch queries SSSD first (passwd: sss files ...), but no
    # SSSD runs in the container, so pam_unix account lookups fail with
    # "cannot retrieve authentication info" -- breaking sudo, crontab, etc. Drop
    # sss so PAM/NSS use the local files that the role populates.
    - name: "Use local files for NSS (no SSSD in the container) - RedHat"
      ansible.builtin.replace:
        path: /etc/nsswitch.conf
        regexp: '^((?:passwd|group|shadow):[ \t]+)sss[ \t]+'
        replace: '\1'
      when: ansible_facts['os_family'] == 'RedHat'

    # The EL9 image's pam_unix account phase returns AUTHINFO_UNAVAIL in the
    # container, so sudo and crontab (both 'account include system-auth') are
    # denied. Make the account phase permissive -- it only validates the local
    # account, which is always present here.
    - name: "Make the PAM account phase permissive in the container - RedHat"
      ansible.builtin.lineinfile:
        path: "{{ item }}"
        line: "account     sufficient    pam_permit.so"
        insertbefore: '^account'
        firstmatch: true
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when: ansible_facts['os_family'] == 'RedHat'

    - name: "Ensure cron is available (the role installs the perforce crontab)"
      ansible.builtin.package:
        name: "{{ 'cron' if ansible_facts['os_family'] == 'Debian' else 'cronie' }}"
        state: present