aboutsummaryrefslogtreecommitdiff
path: root/ansible/roles/superusers
diff options
context:
space:
mode:
Diffstat (limited to 'ansible/roles/superusers')
-rw-r--r--ansible/roles/superusers/tasks/adjust-group.yml21
-rw-r--r--ansible/roles/superusers/tasks/main.yml41
2 files changed, 42 insertions, 20 deletions
diff --git a/ansible/roles/superusers/tasks/adjust-group.yml b/ansible/roles/superusers/tasks/adjust-group.yml
new file mode 100644
index 0000000..32666ad
--- /dev/null
+++ b/ansible/roles/superusers/tasks/adjust-group.yml
@@ -0,0 +1,21 @@
+- vars:
+ members: "{{ getent_group[group][2].split(',') if group in getent_group else [] }}"
+ to_add: "{{ usernames | intersect(superusers) | difference(members) }}"
+ to_remove: "{{ members | difference(superusers) }}"
+ tags: superusers
+ block:
+ - debug: var=group
+ - debug: var=to_add
+ - debug: var=to_remove
+
+ - name: gpasswd --add
+ with_items: "{{ to_add }}"
+ when: (item|length) > 0
+ become: yes
+ shell: "gpasswd --add {{ item }} {{ group }}"
+
+ - name: gpasswd --delete
+ with_items: "{{ to_remove }}"
+ when: (item|length) > 0
+ become: yes
+ shell: "gpasswd --delete {{ item }} {{ group }}"
diff --git a/ansible/roles/superusers/tasks/main.yml b/ansible/roles/superusers/tasks/main.yml
index 3a1e974..70623a0 100644
--- a/ansible/roles/superusers/tasks/main.yml
+++ b/ansible/roles/superusers/tasks/main.yml
@@ -1,26 +1,27 @@
---
-- name: superuser accounts
- tags: superusers
- become: yes
- user:
- name: "{{ item.username }}"
- groups: sudo,systemd-journal
- shell: /bin/bash
- append: yes
- with_items:
- - "{{ superusers }}"
+- tags: superusers
+ block:
+ - name: getent passwd
+ getent:
+ database: passwd
-- name: superuser authorized_keys
- tags: superusers
- become: yes
- authorized_key:
- user: "{{ item.username }}"
- state: "{{ item.state }}"
- key: "{{ users[item.username].authorized_keys }}"
- with_items:
- - "{{ superusers }}"
+ - name: getent group
+ getent:
+ database: group
+
+# NOTE: Accounts are added by the luser module.
+- tags: superusers
+ vars:
+ usernames: "{{ users|dict2items|map(attribute='key')|list }}"
+ unix_groups:
+ - sudo
+ - systemd-journal
+ with_items: "{{ unix_groups }}"
+ loop_control:
+ loop_var: group
+ include_tasks: adjust-group.yml
-- name: Allow 'sudo' group to have passwordless sudo
+- name: "Allow 'sudo' group to have passwordless sudo"
tags: superusers
become: yes
lineinfile: