Graham McIntire
5e8823f4dd
- Remove duplicate firewall include_role from base role (#18) - Move remote_user from [ssh_connection] to [defaults] in ansible.cfg (#20) - Add set -euo pipefail to run.sh (#21) - Delete orphaned playbook_handlers.yml (#22) - Fix changed_when: true in debian tasks (#23) - Add tailscale_authkey env var lookup with TAILSCALE_KEY fallback (#25) - Document -K requirement in bootstrap.yml (#26) - Replace bare ansible_host=mail/git with IP addresses (#27) - Update findings.md
81 lines
2.7 KiB
YAML
81 lines
2.7 KiB
YAML
---
|
|
- name: Bootstrap new host - Setup sudo
|
|
hosts: all
|
|
tags: bootstrap
|
|
remote_user: graham
|
|
gather_facts: false
|
|
vars:
|
|
ansible_user: graham
|
|
tasks:
|
|
# Probe before attempting privilege escalation. If sudo already works for
|
|
# graham, the install-via-su tasks below would otherwise block on a root
|
|
# password prompt that the Makefile's `-K` is designed to feed — and on a
|
|
# passwordless-sudo host with no `-K` provided, hang indefinitely.
|
|
- name: Probe sudo state
|
|
ansible.builtin.raw: |
|
|
if command -v sudo >/dev/null 2>&1; then
|
|
if sudo -n true 2>/dev/null; then
|
|
echo "sudo-passwordless"
|
|
else
|
|
echo "sudo-needs-password"
|
|
fi
|
|
else
|
|
echo "sudo-missing"
|
|
fi
|
|
register: sudo_state
|
|
changed_when: false
|
|
|
|
- name: Ensure sudo is present
|
|
ansible.builtin.raw: |
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update && apt-get install -y sudo
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y sudo
|
|
elif command -v yum >/dev/null 2>&1; then
|
|
yum install -y sudo
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
apk add --no-cache sudo
|
|
else
|
|
echo "Unsupported package manager for sudo installation" >&2
|
|
exit 1
|
|
fi
|
|
become: true
|
|
become_method: su
|
|
become_user: root
|
|
when: "'sudo-missing' in sudo_state.stdout"
|
|
|
|
- name: Ensure Python 3 is present
|
|
ansible.builtin.raw: |
|
|
if command -v python3 >/dev/null 2>&1; then
|
|
exit 0
|
|
fi
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update && apt-get install -y python3 python3-apt
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y python3
|
|
elif command -v yum >/dev/null 2>&1; then
|
|
yum install -y python3
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
apk add --no-cache python3 py3-pip
|
|
else
|
|
echo "Unsupported package manager for python3 installation" >&2
|
|
exit 1
|
|
fi
|
|
changed_when: false
|
|
become: true
|
|
# Once sudo exists (newly installed or pre-existing) prefer it; only fall
|
|
# back to `su` if sudo really isn't there.
|
|
become_method: "{{ 'su' if 'sudo-missing' in sudo_state.stdout else 'sudo' }}"
|
|
become_user: root
|
|
|
|
- name: Bootstrap new host - Base configuration
|
|
hosts: all
|
|
tags: bootstrap
|
|
remote_user: graham
|
|
become: true
|
|
become_method: sudo # Requires -K if graham needs a sudo password (see bootstrap-init target)
|
|
vars:
|
|
ansible_user: graham
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
roles:
|
|
- base
|