generated from nicolabelluti/template-ansible
66 lines
2.0 KiB
YAML
66 lines
2.0 KiB
YAML
# Runs as the installer's desktop user until root is reachable with a key,
|
|
# then switches over and strips that user of its admin rights.
|
|
- name: Authorize the SSH key for root
|
|
become: true
|
|
ansible.posix.authorized_key:
|
|
user: root
|
|
key: "{{ lookup('ansible.builtin.file', install_ssh_keys__ssh_pubkey_path | expanduser) }}"
|
|
|
|
# Empty passwords make Ansible skip sshpass and fall back to the key.
|
|
- name: Switch the connection to root
|
|
ansible.builtin.set_fact:
|
|
ansible_user: root
|
|
ansible_ssh_pass: ''
|
|
ansible_become_password: ''
|
|
|
|
- name: Drop the desktop user connection
|
|
ansible.builtin.meta: reset_connection
|
|
|
|
# Arch already allows root logins with a key. Stop here, with sshd and the
|
|
# desktop user untouched, if root can't get in.
|
|
- name: Check root login
|
|
ansible.builtin.ping:
|
|
|
|
- name: Deploy the sshd configuration
|
|
ansible.builtin.template:
|
|
src: sshd.conf.j2
|
|
dest: /etc/ssh/sshd_config.d/01-bc250.conf
|
|
mode: '0644'
|
|
notify: Reload sshd
|
|
|
|
- name: Validate the sshd configuration
|
|
ansible.builtin.command:
|
|
argv:
|
|
- sshd
|
|
- -t
|
|
changed_when: false
|
|
|
|
- name: Apply the sshd configuration
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: Grant the desktop user the udisks actions Steam needs
|
|
ansible.builtin.template:
|
|
src: deck.rules.j2
|
|
dest: /etc/polkit-1/rules.d/50-bc250-{{ users__desktop_user }}.rules
|
|
mode: '0644'
|
|
|
|
- name: Read the group database
|
|
ansible.builtin.getent:
|
|
database: group
|
|
|
|
- name: Remove the desktop user from the admin groups
|
|
ansible.builtin.user:
|
|
name: "{{ users__desktop_user }}"
|
|
groups: >-
|
|
{{ ansible_facts.getent_group | dict2items
|
|
| selectattr('value.2', 'search', '(^|,)' ~ users__desktop_user ~ '(,|$)')
|
|
| map(attribute='key')
|
|
| difference(users__admin_groups) }}
|
|
append: false
|
|
|
|
# '!' with no hash: password logins are impossible, SDDM autologin still works.
|
|
- name: Remove and lock the desktop user password
|
|
ansible.builtin.user:
|
|
name: "{{ users__desktop_user }}"
|
|
password: '!'
|