mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 19:03:47 +00:00
160d63c02d
* Add Atlas media and storage services * Document Atlas backend phase one and WireGuard deployment * Enable Atlas NAS management and document bootstrap workflow * Harden Atlas network, SSH, firewall, and sharing * Rotate Ansible Vault secrets * Allow configurable Aegis SSH users and authorized keys * Manage Aegis SSH authorized key fragments * Manage SSH authorized key fragments for infrastructure hosts * Harden Rocky storage and sharing configuration * Verify WireGuard handshakes and restore Podman networking
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
---
|
|
- name: Require an existing Unix account for Atlas Samba
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ atlas_samba_account.username }}"
|
|
|
|
- name: Read Atlas Samba account
|
|
ansible.builtin.command:
|
|
argv:
|
|
- pdbedit
|
|
- --list
|
|
- --user
|
|
- "{{ atlas_samba_account.username }}"
|
|
register: atlas_samba_account_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Check Atlas Samba password marker
|
|
ansible.builtin.stat:
|
|
path: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
|
|
register: atlas_samba_password_marker_stat
|
|
|
|
- name: Read Atlas Samba password marker
|
|
ansible.builtin.slurp:
|
|
src: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
|
|
register: atlas_samba_password_marker_content
|
|
no_log: true
|
|
when: atlas_samba_password_marker_stat.stat.exists
|
|
|
|
- name: Determine whether Atlas Samba credentials must change
|
|
ansible.builtin.set_fact:
|
|
atlas_samba_password_digest: "{{ atlas_samba_account.password | hash('sha256') }}"
|
|
atlas_samba_password_update_required: >-
|
|
{{
|
|
atlas_samba_account_check.rc != 0
|
|
or not atlas_samba_password_marker_stat.stat.exists
|
|
or (
|
|
atlas_samba_password_marker_content.content | default('')
|
|
| b64decode | trim
|
|
) != (atlas_samba_account.password | hash('sha256'))
|
|
}}
|
|
no_log: true
|
|
|
|
- name: Set Atlas Samba account password
|
|
ansible.builtin.command:
|
|
argv:
|
|
- smbpasswd
|
|
- -s
|
|
- -a
|
|
- "{{ atlas_samba_account.username }}"
|
|
stdin: "{{ atlas_samba_account.password }}\n{{ atlas_samba_account.password }}"
|
|
changed_when: true
|
|
no_log: true
|
|
when: atlas_samba_password_update_required | bool
|
|
|
|
- name: Record managed Atlas Samba password digest
|
|
ansible.builtin.copy:
|
|
content: "{{ atlas_samba_password_digest }}\n"
|
|
dest: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
when: atlas_samba_password_update_required | bool
|