43 lines
1.1 KiB
YAML
43 lines
1.1 KiB
YAML
---
|
|
# Add zerrtika user with same rights as asxpi (sudo + docker, key-only)
|
|
# and re-apply ssh_hardening so AllowUsers includes the new user.
|
|
# Cloud-init only creates users at first boot; this covers live servers.
|
|
|
|
- name: Create zerrtika user
|
|
hosts: asxpio
|
|
become: true
|
|
vars:
|
|
ansible_host: "{{ wireguard_ip }}"
|
|
|
|
tasks:
|
|
- name: Create user
|
|
ansible.builtin.user:
|
|
name: zerrtika
|
|
groups:
|
|
- sudo
|
|
- docker
|
|
append: true
|
|
shell: /bin/bash
|
|
password_lock: true
|
|
|
|
- name: Authorize SSH key
|
|
ansible.posix.authorized_key:
|
|
user: zerrtika
|
|
key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
|
|
|
|
- name: Grant passwordless sudo
|
|
ansible.builtin.copy:
|
|
dest: /etc/sudoers.d/zerrtika
|
|
content: "zerrtika ALL=(ALL) NOPASSWD:ALL\n"
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: visudo -cf %s
|
|
|
|
- name: Re-apply SSH hardening (AllowUsers)
|
|
hosts: asxpio
|
|
become: true
|
|
vars:
|
|
ansible_host: "{{ wireguard_ip }}"
|
|
roles:
|
|
- ssh_hardening
|