users.yml #2

---
# Create the perforce service account and the ansibleuser automation account,
# along with their SSH setup and sudo rules.

# Perforce user/group
- name: "Create Perforce group"
  ansible.builtin.group:
    name: "{{ perforce_group }}"
    gid: "{{ perforce_gid }}"

- name: "Create Perforce user"
  ansible.builtin.user:
    name: "{{ perforce_user }}"
    uid: "{{ perforce_uid }}"
    comment: "Perforce user"
    group: "{{ perforce_group }}"
    system: true
    generate_ssh_key: false
    home: "/p4"
    shell: "/bin/bash"
    password: "{{ perforce_user_password }}"

- name: "Create .ssh folder"
  ansible.builtin.file:
    state: directory
    path: "/p4/.ssh"
    owner: "{{ perforce_user }}"
    group: "{{ perforce_group }}"
    mode: '0700'

- name: "Create or modify known_hosts file"
  ansible.builtin.file:
    state: "touch"
    path: "/p4/.ssh/known_hosts"
    owner: "{{ perforce_user }}"
    group: "{{ perforce_group }}"
    mode: '0600'
    # Don't bump timestamps on an existing file, so the task is idempotent.
    modification_time: preserve
    access_time: preserve

- name: "Copy ssh configuration file"
  ansible.builtin.copy:
    src: ./ssh_config
    dest: /p4/.ssh/config
    owner: "{{ perforce_user }}"
    group: "{{ perforce_group }}"
    mode: '0600'
    # Seed the base config once; the "Add ssh config lines" blockinfile (main.yml)
    # appends to this file, so don't overwrite it on later runs (idempotence).
    force: false

- name: "Add .vimrc settings"
  ansible.builtin.blockinfile:
    create: true
    path: "/p4/.vimrc"
    insertafter: "EOF"
    owner: "{{ perforce_user }}"
    group: "{{ perforce_group }}"
    mode: '0644'
    marker: '" {mark} ANSIBLE MANAGED BLOCK'
    block: |
      colorscheme industry
      set nocompatible
      set backspace=2

# ansibleuser user/group
- name: "Create ansibleuser group"
  ansible.builtin.group:
    name: ansibleuser

- name: "Create ansibleuser user"
  ansible.builtin.user:
    name: ansibleuser
    comment: "Ansible User for management"
    group: ansibleuser
    system: false
    generate_ssh_key: true
    home: /home/ansibleuser
    shell: /bin/bash
    password: ""
    # 'force' regenerates the SSH key on every run (not idempotent); the key is
    # created once by generate_ssh_key when absent.
    update_password: on_create

- name: "Add ansibleuser to appropriate sudo group"
  ansible.builtin.user:
    name: ansibleuser
    groups: "{{ 'sudo' if ansible_facts['os_family'] == 'Debian' else 'wheel' }}"
    append: true

- name: "Set up ansibleuser sudo file"
  ansible.builtin.copy:
    content: "ansibleuser ALL=(ALL:ALL) NOPASSWD:ALL\n"
    dest: "/etc/sudoers.d/ansibleuser"
    mode: '0440'
    owner: "root"
    group: "root"

- name: "Set up additional admin sudo files"
  ansible.builtin.copy:
    content: "{{ item }} ALL=(ALL:ALL) NOPASSWD:ALL\n"
    dest: "/etc/sudoers.d/{{ item }}"
    mode: '0440'
    owner: "root"
    group: "root"
  loop: "{{ admin_users | default([]) }}"