initializeService.yml

# Run this playbook to initialise the service machines
#
# It disables root login, creates admin users, and puts their ssh keys to the machines.
# You can only run this *once*, because afterwards the root user can't be used to login.
#
# In order to contact a droplet directly as root, you must also disable the SSH proxy
# for a host in your .ssh/config file, like:
#
# #Host service3-ams.internal.php.net
# #    ProxyCommand none
#
# And also comment out the [ssh_connection] section in ansible.cfg (see the
# comment there)

# Example run:
# ansible-playbook initializeSerice.yml --limit analytics --extra-vars "@etc/admins.yml"

- hosts:
  - rsync
  - service

  remote_user: root

  tasks:
  - name: Install rsync
    apt:
      name:
      - rsync
      state: present
      update_cache: yes

  - name: Create local directory
    file:
      state: directory
      dest: /local
      mode: "755"

  - name: Create local systems directory
    file:
      state: directory
      dest: /local/systems
      mode: "755"

  # Install Restic for all services as backup tool https://restic.net/
  - name: Install Restic
    package:
      name: restic
      state: present
      update_cache: yes

  # Add admin user and pubkey everywhere
  - name: Create a linux user and add it to sudo group
    user:
      name: "{{ item.name }}"
      create_home: yes
      state: present
      groups: sudo
      append: yes
      shell: /bin/bash
    loop: "{{ admins }}"

  # Allow members of group sudo to execute any command without specifying their password
  - name: Configure sudoers
    copy:
      dest: /etc/sudoers.d/20-sudo-password
      content: "%sudo ALL=(ALL) NOPASSWD: ALL"

  - name: Copy admin's ssh-keys
    loop: "{{ admins }}"
    include_role:
      name: add_ssh_key
    vars:
      username: "{{ item.name }}"
      pubkeys: "{{ item.pubkeys }}"

  - name: Disable root login
    lineinfile:
      path: /etc/ssh/sshd_config
      regexp: ^PermitRootLogin
      line: PermitRootLogin no
    notify: restart ssh

  handlers:
  - name: restart ssh
    service:
      name: ssh
      state: restarted