83 lines
2.3 KiB
YAML
83 lines
2.3 KiB
YAML
---
|
|
- name: Ensure user exists
|
|
ansible.builtin.user:
|
|
name: "{{ username }}"
|
|
password: "{{ userpass | password_hash('sha512') }}"
|
|
shell: /bin/bash
|
|
state: present
|
|
create_home: yes
|
|
when: useraction == "add"
|
|
|
|
- name: Create .ssh directory
|
|
ansible.builtin.file:
|
|
path: "/home/{{ username }}/.ssh"
|
|
state: directory
|
|
owner: "{{ username }}"
|
|
group: "{{ username }}"
|
|
mode: '0700'
|
|
when: useraction == "add"
|
|
|
|
- name: Upload authorized SSH key
|
|
ansible.builtin.copy:
|
|
src: "files/sshkeys/{{ userkey }}"
|
|
dest: "/home/{{ username }}/.ssh/authorized_keys"
|
|
owner: "{{ username }}"
|
|
group: "{{ username }}"
|
|
mode: '0600'
|
|
when: useraction == "add"
|
|
|
|
- name: Allow {{ username }} to switch to 'docker' user without password
|
|
ansible.builtin.copy:
|
|
dest: "/etc/sudoers.d/{{ username }}-su-docker"
|
|
content: "{{ username }} ALL=(ALL) NOPASSWD: /bin/su - docker"
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
when: useraction == "add"
|
|
|
|
- name: Find processes owned by the user (initial)
|
|
ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true"
|
|
register: user_process_list
|
|
changed_when: false
|
|
when: useraction == "remove"
|
|
|
|
- name: Display processes owned by user before killing
|
|
ansible.builtin.debug:
|
|
msg: "{{ item }}"
|
|
loop: "{{ user_process_list.stdout_lines }}"
|
|
when: useraction == "remove"
|
|
|
|
|
|
- name: Extract PIDs of user processes
|
|
ansible.builtin.shell: "pgrep -u {{ username }} || true"
|
|
register: user_pids
|
|
changed_when: false
|
|
when: useraction == "remove"
|
|
|
|
- name: Kill user processes (if any)
|
|
ansible.builtin.shell: "kill -9 {{ user_pids.stdout_lines | join(' ') }}"
|
|
when:
|
|
- useraction == "remove"
|
|
- user_pids.stdout != ""
|
|
|
|
- name: Remove user and home directory
|
|
ansible.builtin.user:
|
|
name: "{{ username }}"
|
|
state: absent
|
|
remove: yes
|
|
when: useraction == "remove"
|
|
|
|
- name: List remaining processes for the user (after kill)
|
|
ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true"
|
|
register: remaining_procs
|
|
changed_when: false
|
|
when: useraction == "remove"
|
|
|
|
- name: Display remaining processes (manual check)
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Remaining processes for '{{ username }}' after kill:
|
|
{{ remaining_procs.stdout | default('None') }}
|
|
when: useraction == "remove"
|
|
|