common

Installs commonly used packages
Creates administrator accounts and adds them to the wheel, ssh-users and sudo groups
Removes roots password
Sets language, locales and keyboard layout
Configures hostname settings (hostname and /etc/hosts)

Requirements

Remotely: A Debian-based distribution.
Locally: Ansible 2.9 or newer with the ansible.posix collection installed.

Role Variables

Name	Mandatory / Default	Description
`common_admin_users`	`{}`	Dict of admin users, see [User configuration](#User configuration)
`common_users`	`{}`	Dict of normal users, see [User configuration](#User configuration)
`common_jumphost_users`	`{}`	Dict of users that are allowed to use this host as SSH proxy jump host, see [User configuration](#User configuration)
`common_default_admin_user_groups`	`[adm,dialout,users,wheel,ssh-users,sudo]`	Default groups to set for admin users
`common_default_user_groups`	`[]`	Default groups to set for normal users
`common_default_jumphost_user_groups`	`[ssh-users]`	Default groups to set for JumpHost users
`common_ensure_system_groups`	`[ssh-users,wheel,sudo]`	List of groups to create
`common_domain`	`localdomain`	Search domain to set in `/etc/hosts`
`common_locales`	`[en_US.UTF-8]`	List of locales to install
`common_keyboard_layout`	`us,de`	TTY keyboard layout
`common_default_language`	`en_US.UTF-8`	Default language
`common_core_packages`	see defaults	Common core packages to install (like locales or iproute2)
`common_extra_packages`	see defaults	Common extra packages to install (like less or htop)
`common_custom_packages`	`[]`	Custom packages to install, useful if you want to have some extra packages installed without copying and overriding the two lists abvove
`common_core_keys`	`[]`	Common core repo key urls to install
`common_extra_keys`	see defaults	Common extra repo key urls to install
`common_custom_keys`	`[]`	Custom repo key urls to install, useful if you want to have some extra keys installed without copying and overriding the two lists abvove
`common_core_repos`	`[]`	Common core repo urls to install
`common_extra_repos`	see defaults	Common extra repo urls to install
`common_custom_repos`	`[]`	Custom repo urls to install, useful if you want to have some extra repos installed without copying and overriding the two lists abvove
`common_extra_files`	`{}`	A dict with templates for extra files to create on the machine. See [#extra-files].

User configuration

Each key in the respective users dict shall be a username (used to log in), with the following dict as a value:

Name	Mandatory / Default	Description
`name`	✔️	The full name of the admin user
`shell`	`/bin/bash`	Path to the shell to set for this admin (this key is ignored for `common_jumphost_users`)
`keys`	`[]`	List of SSH keys that allow this user to login or proxy-jump via SSH
`passwd`		hashed passphrase
`allowed_hosts`	`[]`	List of hosts and ports to which the user is allowed to jump to (via the current host). The format is `{{ ip }}:{{ port }}`. This key is only parsed for `common_jumphost_users`.
`groups`	`[]`	List of groups the user will be added to. This key overrides the default groups mentioned above (`common_default_user_groups` etc.)`.

Extra Files

The dict common_extra_files configures extra files to create on the machine. Each key must be a file path on the target machine and the containing directory must already exist on the machine. The corresponding value is a dict containing an _module key to choose the Ansible module used to create the file and additional key-value pairs that will be passed to that module. Supported modules (for _module) are copy, template and get_url. Examples:

common_extra_files:
  /etc/zsh/zshrc:
    _module: copy
    src: zshrc # copies the file from ./files/zshrc
  /usr/local/bin/hello-world.sh:
    _module: copy
    content: |
      #!/usr/bin/env bash
      echo Hello, World!
    mode: 0755
  /etc/systemd/resolved.conf:
    _module: template
    src: resolved.conf.j2 # instantiates the file from ./templates/resolved.conf.j2
  /usr/local/bin/danebot.py:
    _module: get_url
    url: https://raw.githubusercontent.com/stuvusIT/danebot/main/src/danebot.py
    mode: 0755

Example Playbook

- hosts: web01
  roles:
    - role: common
      common_admin_users:
        max:
          name: Max Mustermann
          shell: /usr/bin/zsh
          keys:
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5aaaaIEFmmHsB7LgVMmujy51QfoSS9hnN7GMEm+Mkcg1YVJnn max123
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5aaaaIEFmmHsB7LgVMmujy51QfoSS9hnN7GMEm+Mkcg1YVJnn max321
          passwd: $6$mDFWEb5pDY$C9ZTuNjTTSyh0uIBoZALAV6isFY4dO8gBN2/xJ0yX2rejvr2wKp/wMmHwvoC.gD8NaeozxjhWvNHp3rJEJdJj1
        lena:
          name: Lena Mustermann
          keys:
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5aaaaIEFmmHsB7LgVMmujy51QfoSS9hnN7GMEm+Mkcg1YVJnn max123
          groups:
            - users
            - ssh-users
            - wheel
      common_jumphost_users:
        tim:
          name: Tim Mustermann
          keys:
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5aaaaIEFmmHsB7LgVMmujy51QfoSS9hnN7GMEm+Mkcg1YVJnn timey
          allowed_hosts:
            - 196.168.1.5:22
      common_users:
        tom:
          name: Tom Haverford
          groups:
            - users
            - ssh-users
      common_default_language: de_DE.UTF-8
      common_keyboard_layout: de
      common_locales:
        - de_DE.UTF-8
        - en_US.UTF-8
      # common_extra_files: # see the subsection above

License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

Author Information

Markus Mroch (Mr. Pi) markus.mroch@stuvus.uni-stuttgart.de

stuvusIT/common