Коллекция плейбуков Ansible

 1---
 2- name: User configuration
 3  hosts: all
 4  gather_facts: true
 5  become: true
 6
 7  vars:
 8    user_name: "ivan"
 9    user_home: "/home/{{ user_name }}"
10    # Use 'openssl passwd -6' command to get password hash
11    user_password: "$6$k/YKu6N6imR5hAwF$/vodWuLNNnlkE9WjKOPYqanOuiCLZeW2Vhj0z66f7t0HQNfd6URhpEGvM6CyHSUnIFjTG7sY44iKyCD609QFT0"
12    user_groups: ["users", "adm", "sudo"]
13    user_shell: "/usr/bin/zsh"
14    user_ssh_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICJxrVhV4XaBZIxm4FWoCb+RlLkUqq4VCQxe4qepDcqh ivan@r4ven-me"
15
16  tasks:
17    - name: Create user with shell, groups and password
18      ansible.builtin.user:
19        name: "{{ user_name }}"
20        shell: "{{ user_shell }}"
21        groups: "{{ user_groups }}"
22        append: true
23        password: "{{ user_password }}"
24       when: [user_name, user_shell, user_groups, user_password]
25      tags: [user, user_create]
26
27    - name: User SSH configuration
28      block:
29        - name: Create user ssh directory
30          ansible.builtin.file:
31            path: "{{ user_home }}/.ssh/"
32            state: directory
33            owner: "{{ user_name }}"
34            group: "{{ user_name }}"
35            mode: "0700"
36    
37        - name: Add user ssh public key
38          ansible.builtin.lineinfile:
39            path: "{{ user_home }}/.ssh/authorized_keys"
40            line: "{{ user_ssh_pubkey }}"
41            owner: "{{ user_name }}"
42            group: "{{ user_name }}"
43            mode: "0600"
44            create: true
45       when: [user_name, user_home, user_ssh_pubkey]
46      tags: [user, user_ssh]

 1---
 2- name: System upgrade and packages installation
 3  hosts: all
 4  gather_facts: true
 5  become: true
 6  force_handlers: true
 7
 8  vars:
 9    pkgs_upgrade: true
10    pkgs_list:
11      - "sudo"
12      - "vim"
13      - "ncat"
14      - "ncdu"
15      - "curl"
16      - "git"
17
18  tasks:
19      - name: Upgrade system and install packages
20        block:
21          - name: Upgrade system
22            ansible.builtin.apt:
23              upgrade: true # dist | full
24              update_cache: true
25            retries: 3
26            when: pkgs_upgrade
27            tags: [pkgs, pkgs_upgrade]
28
29          - name: Install packages
30            ansible.builtin.apt:
31              name: "{{ pkgs_list }}"
32              state: present
33              update_cache: true
34            retries: 3
35            notify:
36              - Remove useless packages
37              - Remove useless dependencies
38              # - Clean cache
39            when: pkgs_list
40            tags: [pkgs, pkgs_install]
41        when: ansible_distribution in ['Debian', 'Ubuntu']
42
43  handlers:
44    - name: Remove useless packages
45      ansible.builtin.apt:
46        autoclean: true
47
48    - name: Remove useless dependencies
49      ansible.builtin.apt:
50        autoremove: true
51
52    - name: Clean cache
53      ansible.builtin.apt:
54        clean: true

 1---
 2- name: SSH deamon configuration
 3  hosts: all
 4  gather_facts: true
 5  become: true
 6  #force_handlers: true
 7
 8  vars:
 9    ssh_config: "/etc/ssh/sshd_config"
10    ssh_params:
11      Port: "22"
12      AddressFamily: "inet"
13      PermitEmptyPasswords: "no"
14      PermitRootLogin: "no"
15      PubkeyAuthentication: "yes"
16      PasswordAuthentication: "no"
17
18  tasks:
19    - name: Configure SSH daemon
20      ansible.builtin.lineinfile:
21        path: "{{ ssh_config }}"
22        regexp: "^{{ item.key }}.*"
23        line: "{{ item.key }} {{ item.value }}"
24        validate: "/usr/sbin/sshd -t -f %s"
25        owner: "root"
26        group: "root"
27        mode: "0644"
28        backup: true
29        create: true
30      loop: "{{ ssh_params | dict2items }}"
31      notify: Restart sshd service
32      when: ssh_params
33      tags: ssh_daemon
34
35  handlers:
36    - name: Restart sshd service
37      ansible.builtin.systemd_service:
38        name: >-
39          {%- if ansible_facts['distribution'] == 'Debian' -%}
40            sshd
41          {%- elif ansible_facts['distribution'] == 'Ubuntu' -%}
42            ssh
43          {%- else -%}
44            ssh
45          {%- endif -%}
46        daemon_reload: true
47        state: restarted
48        enabled: true