From 8126c26ec39172cdee617c8490bc888a39fb2418 Mon Sep 17 00:00:00 2001 From: hygienic-books Date: Thu, 10 Apr 2025 02:21:42 +0200 Subject: [PATCH] feat(meta): Trim role content --- CHANGELOG.md | 17 --------------- README.md | 39 +++++++++++++++++++++++----------- defaults/main.yml | 9 ++++---- meta/main.yml | 14 +++++------- meta/requirements.yml | 2 -- tasks/40-local-os-password.yml | 38 +++++++-------------------------- tasks/main.yml | 1 + 7 files changed, 45 insertions(+), 75 deletions(-) delete mode 100644 CHANGELOG.md delete mode 100644 meta/requirements.yml diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index b685191..0000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,17 +0,0 @@ -# Change log - -Current version: 0.2.0 - - - -## v0.2.0 (2022-07-24) -### Feature -* **role:** Set and document defaults to make this ready to use out of the box ([`f3042db`](https://quico.space/quico-ansible/role_common_local-os-password/commit/f3042dbf7e69a9009524f2a4f06203a2a5342cf4)) - -## v0.1.0 (2022-07-24) -### Feature -* **role:** Introduce Semantic Versioning a changelog ([`a84a113`](https://quico.space/quico-ansible/role_common_local-os-password/commit/a84a113ef749dc7c543f1b3995efe0e4194f7832)) -* **role:** Initial commit ([`dc9b87b`](https://quico.space/quico-ansible/role_common_local-os-password/commit/dc9b87ba880b58004201199f559b950ada939555)) - -### Fix -* **role:** Import dependency via 'git+https' protocol ([`8a1aa01`](https://quico.space/quico-ansible/role_common_local-os-password/commit/8a1aa0175efa6acf40f2c85dac45375adf0e92e1)) diff --git a/README.md b/README.md index c6475dd..3664fa9 100644 --- a/README.md +++ b/README.md @@ -1,22 +1,33 @@ -# role_common_local-os-password +[//]: # (SPDX-License-Identifier: MIT) +# Role Name -An Ansible role to change an operating system's local user password +role-common-local_os_password -# Defaults +# Description + +Change an operating system's local user password. + +# Requirements + +Your target machines must be Linux. + +# Role Variables This role requires variables defined in [defaults/main.yml](defaults/main.yml). Feel free to overwrite them as needed for your HashiCorp Vault setup for example in a `group_vars` or `host_vars` file. -* `fqdn_reverse`: A variable that contains the reversed fully qualified domain name for each host. For `fully.qualified.domain.name` this variable will equal `name.domain.qualified.fully`. Consider this a suggestion for how to set up your HashiCorp Vault `kv` secrets hierarchy. +- `fqdn_reverse`: A variable that contains the reversed fully qualified domain name for each host. For `fully.qualified.domain.name` this variable will equal `name/domain/qualified/fully` which we then use in our HashiCorp Vault path to retrieve a password and password salt per host and per user. +- `reset_password_for_account`: A list of usernames whose password we want changed. This defaults to: + ``` + reset_password_for_account: + - 'build' + - 'root' + ``` -* `local_os_password_vault_vars`: The variables you want extracted from your Vault instance, by default `['password', 'password_salt']` which contain the new password to set for the local account and a salt, respectively. +# Dependencies -* `local_os_password_vault_base`: The base path where all of `local_os_password_vault_vars` are located in Vault. +None. -* `local_os_password_vault_paths`: The product of both `local_os_password_vault_base` and `local_os_password_vault_vars` stored in a dictionary. This is what the role uses in its `vault_kv2_get` lookup. - -* `reset_password_for_account`: The account for which you'd like to change its local account password, defaults to `root`. - -# Use it +# Example Playbook In your `playbook.yml` call it like so: @@ -24,5 +35,9 @@ In your `playbook.yml` call it like so: - name: 'Awesome playbook' hosts: all roles: - - 'role_common_local-os-password' + - 'role-common-local_os_password' ``` + +# License + +MIT diff --git a/defaults/main.yml b/defaults/main.yml index b848b22..c12f66d 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,6 +1,5 @@ -# role_common_local-os-password +# SPDX-License-Identifier: MIT fqdn_reverse: '{{ inventory_hostname | split(".") | reverse | join("/") }}' -local_os_password_vault_vars: ['password', 'password_salt'] -local_os_password_vault_base: '{{ fqdn_reverse }}/os/{{ reset_password_for_account }}' -local_os_password_vault_paths: '{{ [local_os_password_vault_base + ''/''] | product(local_os_password_vault_vars) | map(''join'') | list }}' -reset_password_for_account: 'root' +reset_password_for_account: + - 'build' + - 'root' diff --git a/meta/main.yml b/meta/main.yml index 9f31cce..79a83d4 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -1,14 +1,10 @@ +# SPDX-License-Identifier: MIT galaxy_info: author: 'hygienic-books' - description: 'An Ansible role to change an operating system''s local user password' - issue_tracker_url: 'https://quico.space/quico-ansible/role_common_local-os-password/issues' - license: 'MIT' - min_ansible_version: '2.12.6' - platforms: - - name: 'EL' - versions: - - '7' - - '8' + description: 'Change an operating system''s local user password' + license: MIT + min_ansible_version: 2.18.1 galaxy_tags: + - 'os' - 'password' dependencies: [] diff --git a/meta/requirements.yml b/meta/requirements.yml deleted file mode 100644 index 21b12c7..0000000 --- a/meta/requirements.yml +++ /dev/null @@ -1,2 +0,0 @@ -- src: 'git+https://quico.space/quico-ansible/role_include_vault-check.git' - version: 'master' diff --git a/tasks/40-local-os-password.yml b/tasks/40-local-os-password.yml index d5e9a9e..c9af037 100644 --- a/tasks/40-local-os-password.yml +++ b/tasks/40-local-os-password.yml @@ -1,33 +1,11 @@ -- name: 'Get secrets' - no_log: 'true' - loop_control: - loop_var: 'server' - with_community.hashi_vault.vault_kv2_get: '{{ local_os_password_vault_paths }}' - ansible.builtin.set_fact: - vault_data: '{{ vault_data | default({}) | combine (server.secret) }}' - - - -- name: 'If a secret is missing: Fail progress' - import_role: - name: 'role_include_vault-check' - vars: - - vault_check_base_path: '{{ local_os_password_vault_base }}' - - vault_check_inc_vault_data: '{{ vault_data }}' - - vault_check_fail_checks: '{{ local_os_password_vault_vars }}' - - - -- name: 'Set fact: New OS local account password' - no_log: 'true' - ansible.builtin.set_fact: - os_acc_pwd: '{{ vault_data.password }}' - os_acc_salt: '{{ vault_data.password_salt }}' - - - +# SPDX-License-Identifier: MIT - name: 'Set local OS account password' + loop_control: + loop_var: 'account' + index_var: 'i' + label: 'Set password for local account ''{{ account }}''' + loop: '{{ reset_password_for_account }}' ansible.builtin.user: - name: '{{ reset_password_for_account }}' - password: '{{ os_acc_pwd | string | password_hash(''sha512'', os_acc_salt) }}' + name: '{{ account }}' + password: '{{ lookup(''hashi_vault'', ''secret=kv/data/settings/machines/'' + fqdn_reverse + ''/os/user/'' + account + '':password'') | string | password_hash(''sha512'', lookup(''hashi_vault'', ''secret=kv/data/settings/machines/'' + fqdn_reverse + ''/os/user/'' + account + '':password_salt'')) }}' update_password: 'always' diff --git a/tasks/main.yml b/tasks/main.yml index 31db0e8..d3ad8a8 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1 +1,2 @@ +# SPDX-License-Identifier: MIT - import_tasks: '40-local-os-password.yml'