ansible-edda/playbooks/roles/services/setup/user/tasks/include/user.yml

46 lines
1.7 KiB
YAML
Raw Normal View History

2022-12-18 23:43:40 +01:00
---
2022-12-12 23:49:20 +01:00
- name: "{{ services_service_name }} : setup : create system user"
2022-12-11 00:41:50 +01:00
ansible.builtin.user:
name: "{{ services_service_user_name }}"
create_home: true
home: "{{ services_service_user_home }}"
system: true
register: services_base_user_create
2022-12-12 23:49:20 +01:00
- name: "{{ services_service_name }} : setup : set default shell"
2022-12-11 00:41:50 +01:00
ansible.builtin.user:
name: "{{ services_service_user_name }}"
2023-07-22 23:51:34 +02:00
shell: "/usr/sbin/nologin"
2022-12-11 00:41:50 +01:00
- block:
2022-12-12 23:49:20 +01:00
- name: "{{ services_service_name }} : setup : set home directory ownership"
2022-12-11 00:41:50 +01:00
ansible.builtin.file:
path: "{{ services_service_user_home }}"
state: "directory"
owner: "{{ services_service_user_name }}"
group: "{{ services_service_user_name }}"
recurse: true
2022-12-12 23:49:20 +01:00
- name: "{{ services_service_name }} : setup : configure subuids and subgids"
2022-12-11 00:41:50 +01:00
ansible.builtin.shell: |
2023-11-04 21:19:09 +01:00
set -o pipefail
2022-12-11 00:41:50 +01:00
export NEW_SUBUID=$(($(tail -1 /etc/subuid | awk -F ":" '{print $2}')+65536))
export NEW_SUBGID=$(($(tail -1 /etc/subgid | awk -F ":" '{print $2}')+65536))
usermod --add-subuids ${NEW_SUBUID}-$((${NEW_SUBUID}+65535)) \
--add-subgids ${NEW_SUBGID}-$((${NEW_SUBGID}+65535)) \
{{ services_service_user_name }}
2023-11-04 21:19:09 +01:00
args:
executable: "/usr/bin/bash"
2022-12-11 00:41:50 +01:00
2022-12-12 23:49:20 +01:00
- name: "{{ services_service_name }} : setup : ensure XDG_RUNTIME_DIR is set"
2022-12-11 00:41:50 +01:00
ansible.builtin.shell: |
echo '\nexport XDG_RUNTIME_DIR=/run/user/$(id -u)' >> \
{{ services_service_user_home }}/.bashrc
2022-12-12 23:49:20 +01:00
- name: "{{ services_service_name }} : setup : enable lingering"
2022-12-11 00:41:50 +01:00
ansible.builtin.command: "loginctl enable-linger {{ services_service_user_name }}"
when:
services_base_user_create.changed