chore(deps): pin dependencies

.gitea/workflows/ansible-linters.yaml

@@ -12,9 +12,9 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Run ansible-lint
-      uses: ansible/ansible-lint@v25.7.0
+      uses: ansible/ansible-lint@5fac056c45595896c973fbde871f01f6cb14d74c # v26.4.0
       with:
         args: "--config-file .ansible-lint"
         setup_python: "true"

.gitea/workflows/markdown-linters.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.2.2
-    - uses: DavidAnson/markdownlint-cli2-action@v20.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: DavidAnson/markdownlint-cli2-action@30a0e04f1870d58f8d717450cc6134995f993c63 # v21.0.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -0,0 +1,22 @@
+name: Release Ansible Role
+
+on:
+  push:
+    tags:
+    - '**'
+  workflow_dispatch: {}
+
+jobs:
+  release:
+    name: Release Ansible Role
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install Ansible Galaxy
+      run: |
+        apt update --yes
+        apt install --yes ansible
+    - env:
+        ANSIBLE_GALAXY_TOKEN: ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
+      name: Update Ansible Role in Ansible Galaxy
+      run: |
+        ansible-galaxy role import --token=${ANSIBLE_GALAXY_TOKEN} volker-raschek ${GITHUB_REPOSITORY#*/}

.vscode/settings.json

@@ -0,0 +1,14 @@
+{
+  "ansible.python.interpreterPath": "/bin/python",
+  "files.associations": {
+    "**/.gitea/**/*.yml": "yaml",
+    "**/.gitea/**/*.yaml": "yaml",
+    "docker-compose*.yml": "dockercompose",
+    "*.yml": "ansible",
+    "*.yaml": "ansible",
+    ".yamllint": "yaml",
+    ".yamllint.yml": "yaml",
+    ".yamllint.yaml": "yaml"
+  },
+  "rewrap.wrappingColumn": 120
+}

README.md

@@ -77,7 +77,11 @@ The SSH client directory `~/.ssh` can also be managed via the Ansible role. This
 `~/.ssh/config`, `~/.ssh/authorized_keys` as well as the maintenance of private and public SSH keys.
 
 The following example create two entries in `~/.ssh/authorized_keys`. One normal SSH access for `claire`. If `bob`
-establish a SSH connection the command `/usr/local/bin/upload-file.sh` will be executed and exited.
+establish a SSH connection the command `/usr/local/bin/upload-file.sh` will be executed and exited. Furthermore,
+environment variables can be espcilitly defined, to consume it during execution of the command.
+
+> [!IMPORTANT]
+> To allow consuming environment variables must be set `PermitUserEnvironment yes` in `/etc/ssh/sshd_config`.
 
 The private key `toor@toor-pc.ed25519.key` must be stored in `ssh/private_keys`. The public key will be automatically
 extracted from the private key.
@@ -99,6 +103,9 @@ unix_users:
       authorized_keys:
       - filename: claire@claire-pc.pub
       - command: /usr/local/bin/upload-file.sh
+        envs:
+        - key: SSH_KEY_NAME
+          value: bob@bob-pc
         filename: bob@bob-pc.pub
       private_keys:
       - toor@toor-pc.ed25519.key

meta/main.yaml

@@ -4,24 +4,24 @@ galaxy_info:
   company: "Cryptic Systems"
   description: "Role to create and configure unix users and groups"
   galaxy_tags:
-    - system
-    - user
-    - unix
-    - linux
+  - system
+  - user
+  - unix
+  - linux
   license: "MIT"
   min_ansible_version: "2.9"
   namespace: volker-raschek
   platforms:
-    - name: ArchLinux
-      versions:
-        - all
-    - name: EL
-      versions:
-        - all
-    - name: Fedora
-      versions:
-        - all
-    - name: Ubuntu
-      versions:
-        - all
+  - name: ArchLinux
+    versions:
+    - all
+  - name: EL
+    versions:
+    - all
+  - name: Fedora
+    versions:
+    - all
+  - name: Ubuntu
+    versions:
+    - all
   role_name: "unix_users"

tasks/create_unix_user.yaml

@@ -8,9 +8,33 @@
   when: unix_user.value.btrfs is defined and
         unix_user.value.btrfs
   block:
+  - name: "Find btrfs device"
+    ansible.builtin.command:
+      cmd: /bin/bash -c "findmnt -no SOURCE -T {{ user_user_home }} | sed 's/\[.*\]//'"
+    register: _unix_users_btrfs_device
+    failed_when: _unix_users_btrfs_device.rc != 0
+    changed_when: _unix_users_btrfs_device.rc == 0
+
+  - name: "Found btrfs device"
+    ansible.builtin.debug:
+      msg: _unix_users_btrfs_device.stdout
+    when: _unix_users_debug is defined and
+          _unix_users_debug is true
+
+  - name: "Determine filesystem of device"
+    ansible.builtin.set_fact:
+      _unix_users_device_filesystem: "{{ ansible_facts['mounts'] | selectattr('device', 'equalto', _unix_users_btrfs_device.stdout) | map(attribute='fstype') | first }}"
+
+  - name: "Fail if device does not have a btrfs file system"
+    ansible.builtin.fail:
+      msg: "Determined device {{ _unix_users_btrfs_device.stdout }} does not have a btrfs filesystem"
+    when: _unix_users_device_filesystem != 'btrfs'
+
   - name: "Create btrfs volume for unix user: {{ unix_user.key }}"
     community.general.btrfs_subvolume:
+      filesystem_device: "{{ _unix_users_btrfs_device.stdout }}"
       name: "{{ user_user_home }}"
+      state: present
   - name: "Adapt home dir permissions"
     ansible.builtin.file:
       path: "{{ user_user_home }}"
@@ -76,7 +100,7 @@
         unix_user.value.btrfs
   block:
   - name: "Copy skel files"
-    ansible.builtin.include_tasks: copy_skel_file.yml
+    ansible.builtin.include_tasks: copy_skel_file.yaml
     loop_control:
       loop_var: skel_file
     with_items:
@@ -190,7 +214,7 @@
 
 - name: "Create shell rc files"
   when: unix_user.value.shell_rc_files is defined
-  ansible.builtin.include_tasks: create_shell_rc_file.yml
+  ansible.builtin.include_tasks: create_shell_rc_file.yaml
   with_items:
   - "{{ unix_user.value.shell_rc_files }}"
   loop_control:

tasks/main.yaml

@@ -1,7 +1,7 @@
 ---
 
 - name: Remove unix user
-  ansible.builtin.include_tasks: remove_unix_user.yml
+  ansible.builtin.include_tasks: remove_unix_user.yaml
   with_dict: "{{ unix_users }}"
   loop_control:
     loop_var: unix_user
@@ -11,7 +11,7 @@
         unix_user.value.state == 'absent'
 
 - name: Remove unix groups
-  ansible.builtin.include_tasks: remove_unix_group.yml
+  ansible.builtin.include_tasks: remove_unix_group.yaml
   with_dict: "{{ unix_groups }}"
   loop_control:
     loop_var: unix_group
@@ -21,7 +21,7 @@
         unix_group.value.state == 'absent'
 
 - name: Create unix groups
-  ansible.builtin.include_tasks: create_unix_group.yml
+  ansible.builtin.include_tasks: create_unix_group.yaml
   with_dict: "{{ unix_groups }}"
   loop_control:
     loop_var: unix_group
@@ -33,7 +33,7 @@
         )
 
 - name: Create unix users
-  ansible.builtin.include_tasks: create_unix_user.yml
+  ansible.builtin.include_tasks: create_unix_user.yaml
   no_log: true
   with_dict: "{{ unix_users }}"
   loop_control:

templates/authorized_keys.j2

@@ -3,9 +3,26 @@
 # {{ ansible_managed }}
 #
 {% for authorized_key in unix_user.value.ssh.authorized_keys %}
-{% if authorized_key.command is defined and authorized_key.command | length > 0 %}
-command="{{ authorized_key.command }}" {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
-{% else %}
+  {% set _args = [] %}
+  {% if authorized_key.command is defined and authorized_key.command | length > 0 %}
+    {% set _args = _args + [ "command=\"" + authorized_key.command + "\"" ] %}
+  {% endif %}
+  {% if authorized_key.envs is defined %}
+    {% set ns = namespace(envs=[]) %}
+    {% for environment in authorized_key.envs %}
+      {% if environment.key is defined and environment.key | length > 0 and
+            environment.value is defined and environment.value | length > 0
+      %}
+        {% set ns.envs = ns.envs + [ environment.key + "=" + environment.value ] %}
+      {% endif %}
+    {% endfor %}
+    {% if ns.envs | length > 0 %}
+      {% set _args = _args + [ "environment=\"" + (ns.envs | join(',')) + "\"" ] %}
+    {% endif %}
+  {% endif %}
+  {% if _args | length > 0 %}
+{{ _args | join(',') }} {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+  {% else %}
 {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
-{% endif %}
+  {% endif %}
 {% endfor %}

templates/netrc.j2

@@ -1,3 +1,3 @@
 {% for netrc in unix_user.value.netrc %}
-machine {{ netrc.maschine }} login {{ netrc.login }} password {{ netrc.password }}
+machine {{ netrc.machine }} login {{ netrc.login }} password {{ netrc.password }}
 {% endfor %}