Initial base playbooks

Signed-off-by: Nis Wechselberg <enbewe@enbewe.de>

playbooks/access.yml

@@ -0,0 +1,36 @@
+---
+- name: 'Configure access permissions'
+  hosts: 'all'
+
+  vars:
+    ssh_public_keys_exclusive: true
+
+  tasks:
+    - name: 'Install ssh keys in target system'
+      ansible.posix.authorized_key:
+        user: '{{ ansible_user }}'
+        key: '{{ ssh_public_keys }}'
+        exclusive: '{{ ssh_public_keys_exclusive }}'
+
+    - name: 'Allow ansible user to use sudo'
+      become: true
+      ansible.builtin.template:
+        src: 'sudoers.d/ansible.j2'
+        dest: '/etc/sudoers.d/ansible'
+        owner: 'root'
+        group: 'root'
+        mode: 'u=rw,g=r,o='
+
+    - name: 'Disallow ssh password login'
+      become: true
+      ansible.builtin.lineinfile:
+        path: '/etc/ssh/sshd_config'
+        regexp: '^#?PasswordAuthentication '
+        line: 'PasswordAuthentication no'
+
+    - name: 'Disallow ssh root login without key'
+      become: true
+      ansible.builtin.lineinfile:
+        path: '/etc/ssh/sshd_config'
+        regexp: '^#?PermitRootLogin '
+        line: 'PermitRootLogin prohibit-password'

playbooks/known_hosts.yml

@@ -0,0 +1,14 @@
+---
+- name: 'Install SSH keys as known hosts'
+  hosts: 'all'
+  serial: 1
+  gather_facts: false
+
+  tasks:
+    - name: 'Register host key'
+      delegate_to: 'localhost'
+      throttle: 1
+      when: 'ssh_ed25519'
+      ansible.builtin.known_hosts:
+        name: '{{ inventory_hostname }}'
+        key: '{{ inventory_hostname }} ssh-ed25519 {{ ssh_ed25519 }}'

playbooks/motd.yml

@@ -0,0 +1,14 @@
+---
+- name: 'Configure Motd components'
+  hosts: 'all'
+
+  tasks:
+    - name: 'Remove components from motd, that are not needed'
+      become: true
+      ansible.builtin.file:
+        state: 'file'
+        path: '/etc/update-motd.d/{{ item }}'
+        mode: 'u=rw,g=r,o=r'
+      loop:
+        - '10-help-text'
+        - '50-motd-news'

playbooks/templates/sudoers.d/ansible.j2

@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+
+# Allow user for ansible to use sudo without password
+{{ ansible_user }}    ALL=(ALL:ALL) NOPASSWD: ALL

playbooks/ubuntu_pro.yml

@@ -0,0 +1,40 @@
+---
+- name: 'Configure Ubuntu Pro subscription'
+  hosts: 'ubuntu_pro'
+
+  tasks:
+    - name: 'Install required software'
+      become: true
+      ansible.builtin.apt:
+        name: 'ubuntu-advantage-tools'
+        state: 'present'
+
+    - name: 'Register this host on Ubuntu Pro (pro attach <token>)'
+      become: true
+      ansible.builtin.command: 'pro attach {{ ubuntu_pro_token }}'
+      register: 'reg_pro_attach'
+      changed_when: 'reg_pro_attach.rc == 0'
+      failed_when:
+        - 'reg_pro_attach.rc != 0'
+        - '"This machine is already attached to" not in reg_pro_attach.stderr_lines[0]'
+
+    - name: 'Enable selected Ubuntu Pro services'
+      become: true
+      ansible.builtin.command: 'pro enable {{ item }}'
+      register: 'reg_pro_enable'
+      changed_when: 'reg_pro_enable.rc == 0'
+      failed_when:
+        - 'reg_pro_enable.rc != 0'
+        - '"is already enabled" not in reg_pro_enable.stdout_lines[1]'
+        - '"is not available for" not in reg_pro_enable.stdout_lines[1]'
+      loop: '{{ ubuntu_pro_enabled_services }}'
+
+    - name: 'Disable selected Ubuntu Pro services'
+      become: true
+      ansible.builtin.command: 'pro disable {{ item }}'
+      register: 'reg_pro_disable'
+      changed_when: 'reg_pro_disable.rc == 0'
+      failed_when:
+        - 'reg_pro_disable.rc != 0'
+        - '"is not currently enabled not" in reg_pro_disable.stdout_lines[0]'
+      loop: '{{ ubuntu_pro_disabled_services }}'

playbooks/update.yml

@@ -0,0 +1,22 @@
+---
+- name: 'Install updates through package management'
+  hosts: 'all'
+
+  pre_tasks:
+    - name: 'Update package cache if needed'
+      become: true
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+
+  tasks:
+    - name: 'Install all available update'
+      become: true
+      ansible.builtin.apt:
+        upgrade: 'dist'
+
+    - name: 'Remove unneeded dependencies and leftover packages from cache'
+      become: true
+      ansible.builtin.apt:
+        autoclean: true
+        autoremove: true