Add debian common role

common-debian/tasks/users/admin.yml

@@ -0,0 +1,77 @@
+---
+- name: "ensure {{ item.name }} user exists and is configured properly"
+  user:
+    name: "{{ item.name }}"
+    uid: "{{ item.uid }}"
+    group: operator
+    groups: "adm,sudo,{{ item.add_groups|join(',') }}"
+    shell: "{{ item.shell }}"
+    home: "/var/home/{{ item.name }}"
+    createhome: yes
+    move_home: yes
+    append: yes
+    state: present
+
+- name: "set ownership of {{ item.name }} home directory"
+  file:
+    dest: "/var/home/{{ item.name }}"
+    state: directory
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0700
+
+- name: "create {{ item.name }} .ssh configuration directory"
+  file:
+    dest: "/var/home/{{ item.name }}/.ssh"
+    state: directory
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0700
+
+- name: "write {{ item.name }} ssh authorized_keys configuration file"
+  template:
+    src: var/home/user/ssh/authorized_keys.j2
+    dest: "/var/home/{{ item.name }}/.ssh/authorized_keys"
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0640
+
+- name: "write {{ item.name }} profile configuration file"
+  template:
+    src: var/home/user/profile.j2
+    dest: "/var/home/{{ item.name }}/.profile"
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0750
+
+- name: "write {{ item.name }} bashrc configuration file"
+  template:
+    src: var/home/user/bashrc.j2
+    dest: "/var/home/{{ item.name }}/.bashrc"
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0750
+
+- name: "write {{ item.name }} bash_logout configuration file"
+  template:
+    src: var/home/user/bash_logout.j2
+    dest: "/var/home/{{ item.name }}/.bash_logout"
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0750
+
+- name: "create {{ item.name }} vim state directory"
+  file:
+    dest: "/var/home/{{ item.name }}/.vim"
+    state: directory
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0700
+
+- name: "write {{ item.name }} vimrc configuration file"
+  template:
+    src: var/home/user/vimrc.j2
+    dest: "/var/home/{{ item.name }}/.vimrc"
+    owner: "{{ item.name }}"
+    group: operator
+    mode: 0600

common-debian/tasks/users/backup.yml

@@ -0,0 +1,40 @@
+---
+- name: ensure backup user has /bin/sh shell
+  user:
+    name: backup
+    shell: /bin/sh
+    state: present
+
+- name: create backup .ssh configuration directory
+  file:
+    dest: /var/backups/.ssh
+    state: directory
+    owner: backup
+    group: operator
+    mode: 0700
+
+- name: write backup ssh authorized_keys configuration file
+  template:
+    src: var/backups/ssh/authorized_keys.j2
+    dest: /var/backups/.ssh/authorized_keys
+    owner: backup
+    group: operator
+    mode: 0640
+
+- name: install post-backup timestamp script
+  template:
+    src: var/backups/timestamp.sh.j2
+    dest: /var/backups/timestamp.sh
+    mode: 0755
+
+- name: create backup shares file
+  command: touch /var/backups/shares
+  args:
+    creates: /var/backups/shares
+
+- name: set ownership of backup shares file
+  file:
+    dest: /var/backups/shares
+    owner: backup
+    group: operator
+    mode: 0644

common-debian/tasks/users/deploy.yml

@@ -0,0 +1,35 @@
+---
+- name: ensure deploy user exists and is configured properly
+  user:
+    name: deploy
+    uid: 200
+    group: operator
+    shell: /bin/bash
+    home: /var/home/deploy
+    createhome: yes
+    move_home: yes
+    state: present
+
+- name: set ownership of deploy home directory
+  file:
+    dest: /var/home/deploy
+    state: directory
+    owner: deploy
+    group: operator
+    mode: 0700
+
+- name: create deploy .ssh configuration directory
+  file:
+    dest: /var/home/deploy/.ssh
+    state: directory
+    owner: deploy
+    group: operator
+    mode: 0700
+
+- name: write deploy ssh authorized_keys configuration file
+  template:
+    src: var/home/deploy/ssh/authorized_keys.j2
+    dest: /var/home/deploy/.ssh/authorized_keys
+    owner: deploy
+    group: operator
+    mode: 0640

common-debian/tasks/users/root.yml

@@ -0,0 +1,23 @@
+---
+- name: set root password
+  user:
+    name: root
+    password: "{{ root_password | password_hash('sha512', root_password) }}" # Use password as salt for idemptence
+    state: present
+
+- name: remove any root known_hosts configuration file
+  file:
+    dest: /root/.ssh/known_hosts
+    state: absent
+
+- name: create root vim state directory
+  file:
+    dest: /root/.vim
+    state: directory
+    mode: 0700
+
+- name: write admin user vimrc configuration file to root homedir
+  template:
+    src: var/home/user/vimrc.j2
+    dest: /root/.vimrc
+    mode: 0600