Initial base playbooks

Signed-off-by: Nis Wechselberg <enbewe@enbewe.de>

playbooks/access.yml

@@ -0,0 +1,22 @@
+---
+- name: 'Configure access permissions'
+  hosts: 'all'
+
+  vars:
+    ssh_public_keys_exclusive: true
+
+  tasks:
+    - name: 'Install ssh keys in target system'
+      ansible.posix.authorized_key:
+        user: '{{ ansible_user }}'
+        key: '{{ ssh_public_keys }}'
+        exclusive: '{{ ssh_public_keys_exclusive }}'
+
+    - name: 'Allow ansible user to use sudo'
+      become: true
+      ansible.builtin.template:
+        src: 'sudoers.d/ansible.j2'
+        dest: '/etc/sudoers.d/ansible'
+        owner: 'root'
+        group: 'root'
+        mode: 'u=rw,g=r,o='

playbooks/known_hosts.yml

@@ -0,0 +1,14 @@
+---
+- name: 'Install SSH keys as known hosts'
+  hosts: 'all'
+  serial: 1
+  gather_facts: false
+
+  tasks:
+    - name: 'Register host key'
+      delegate_to: 'localhost'
+      throttle: 1
+      when: 'ssh_ed25519'
+      ansible.builtin.known_hosts:
+        name: '{{ inventory_hostname }}'
+        key: '{{ inventory_hostname }} ssh-ed25519 {{ ssh_ed25519 }}'

playbooks/templates/sudoers.d/ansible.j2

@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+
+# Allow user for ansible to use sudo without password
+{{ ansible_user }}    ALL=(ALL:ALL) NOPASSWD: ALL

playbooks/update.yml

@@ -0,0 +1,22 @@
+---
+- name: 'Install updates through package management'
+  hosts: 'all'
+
+  pre_tasks:
+    - name: 'Update package cache if needed'
+      become: true
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+
+  tasks:
+    - name: 'Install all available update'
+      become: true
+      ansible.builtin.apt:
+        upgrade: 'dist'
+
+    - name: 'Remove unneeded dependencies and leftover packages from cache'
+      become: true
+      ansible.builtin.apt:
+        autoclean: true
+        autoremove: true