volker.raschekandCopilot
09f4b9fe4c
The conditions relied on 'is defined' and 'is not defined'. An entry which declares the unused key with an empty string - as documented in defaults/main.yaml - matched none of the four tasks, so the sudoers drop-in file was silently not created. Comparing the length of the defaulted values instead makes exactly one task apply to every entry accepted by the validation. Co-authored-by: Copilot <copilot@github.com>
106 lines
3.7 KiB
YAML
106 lines
3.7 KiB
YAML
---
|
|
|
|
- name: Include OS-specific variables
|
|
ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
|
|
vars:
|
|
params:
|
|
files:
|
|
- "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yaml"
|
|
- "{{ ansible_facts['distribution'] }}.yaml"
|
|
- "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yaml"
|
|
- "{{ ansible_facts['os_family'] }}.yaml"
|
|
- main.yaml
|
|
paths:
|
|
- vars
|
|
|
|
- name: Verify variables
|
|
ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
|
|
vars:
|
|
params:
|
|
files:
|
|
- "{{ ansible_facts['distribution'] }}_verify_vars.yaml"
|
|
- "{{ ansible_facts['os_family'] }}_verify_vars.yaml"
|
|
- verify_vars.yaml
|
|
paths:
|
|
- tasks
|
|
|
|
- name: Install sudo
|
|
ansible.builtin.package:
|
|
name: "{{ item }}"
|
|
state: present
|
|
with_items: "{{ sudo_users_package_names }}"
|
|
|
|
- name: Enable includedir directive
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
# sudo >= 1.9.1 ships the directive as @includedir, older releases as #includedir
|
|
regexp: "^[#@]+(\\s)*includedir(\\s)*/etc/sudoers\\.d"
|
|
line: "#includedir /etc/sudoers.d"
|
|
validate: 'visudo --check --file %s'
|
|
mode: "0440"
|
|
owner: "root"
|
|
group: "root"
|
|
|
|
- name: Create drop-in directory of sudoers
|
|
ansible.builtin.file:
|
|
state: directory
|
|
path: "/etc/sudoers.d"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0750"
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix users"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.user) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
user: "{{ item.user }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user | default('') | length > 0 and
|
|
item.group | default('') | length == 0 and
|
|
item.runas | default('') | length == 0
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix users as specific unix user"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.user) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
user: "{{ item.user }}"
|
|
runas: "{{ item.runas }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user | default('') | length > 0 and
|
|
item.group | default('') | length == 0 and
|
|
item.runas | default('') | length > 0
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix groups"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.group) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
group: "{{ item.group }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user | default('') | length == 0 and
|
|
item.group | default('') | length > 0 and
|
|
item.runas | default('') | length == 0
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix groups as specifix unix user"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.group) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
group: "{{ item.group }}"
|
|
runas: "{{ item.runas }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user | default('') | length == 0 and
|
|
item.group | default('') | length > 0 and
|
|
item.runas | default('') | length > 0
|