diff --git a/dhcp.yml b/dhcp.yml new file mode 100644 index 0000000..4c2ef3e --- /dev/null +++ b/dhcp.yml @@ -0,0 +1,8 @@ +--- +# Deploy DHCP +- hosts: dhcp-pacaterie.adm.auro.re + vars: + service_repo: https://gitlab.federez.net/re2o/dhcp.git + service_name: dhcp + roles: + - re2o-service diff --git a/roles/re2o-service/defaults/main.yml b/roles/re2o-service/defaults/main.yml new file mode 100644 index 0000000..343c392 --- /dev/null +++ b/roles/re2o-service/defaults/main.yml @@ -0,0 +1,3 @@ +--- +service_user: re2o-services +service_homedir: /var/local/re2o-services diff --git a/roles/re2o-service/tasks/main.yml b/roles/re2o-service/tasks/main.yml new file mode 100644 index 0000000..7333883 --- /dev/null +++ b/roles/re2o-service/tasks/main.yml @@ -0,0 +1,24 @@ +--- +# Create service user +- include_tasks: service_user.yml + +- name: "Clone re2o {{ service_name }} project" + git: + repo: "{{ service_repo }}" + dest: "{{ service_homedir }}/{{ service_name }}" + version: master + become: true + become_user: "{{ service_user }}" + +- name: Indicate in motd service location + template: + src: update-motd.d/05-service.j2 + dest: "/etc/update-motd.d/05-re2o-{{ service_name }}" + mode: 0755 + +- name: Indicate in motd service user + template: + src: update-motd.d/06-service-user.j2 + dest: "/etc/update-motd.d/06-service-user" + mode: 0755 + diff --git a/roles/re2o-service/tasks/service_user.yml b/roles/re2o-service/tasks/service_user.yml new file mode 100644 index 0000000..0818676 --- /dev/null +++ b/roles/re2o-service/tasks/service_user.yml @@ -0,0 +1,19 @@ +--- +# Having a custom group is useless so use nogroup +- name: "Create {{ service_user }} user" + user: + name: "{{ service_user }}" + group: nogroup + home: "{{ service_homedir }}" + system: true + shell: /bin/false + state: present + +# Only service user should be able to go there +- name: "Secure {{ service_user }} home directory" + file: + path: "{{ service_homedir }}" + state: directory + owner: "{{ service_user }}" + group: nogroup + mode: 0700 diff --git a/roles/re2o-service/templates/update-motd.d/05-service.j2 b/roles/re2o-service/templates/update-motd.d/05-service.j2 new file mode 100755 index 0000000..a7b8468 --- /dev/null +++ b/roles/re2o-service/templates/update-motd.d/05-service.j2 @@ -0,0 +1,3 @@ +#!/bin/sh +# {{ ansible_managed }} +echo "✨ Le service re2o {{ service_name }} est dans {{ service_homedir }}/{{ service_name }}." diff --git a/roles/re2o-service/templates/update-motd.d/06-service-user.j2 b/roles/re2o-service/templates/update-motd.d/06-service-user.j2 new file mode 100755 index 0000000..5def259 --- /dev/null +++ b/roles/re2o-service/templates/update-motd.d/06-service-user.j2 @@ -0,0 +1,3 @@ +#!/bin/sh +# {{ ansible_managed }} +echo " Pour y accéder, vous devez impersonifier {{ service_user }}."