ansible
/
xoxys.sudo
0
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: ansible:main
Branches Tags
ansible:main
ansible:docs
...
pull from: ansible:docs
Branches Tags
ansible:main
ansible:docs

No commits in common. "main" and "docs" have entirely different histories.
main ... docs

21 changed files with 8 additions and 434 deletions
Show Stats Expand all files Collapse all files

11
.gitignore vendored
View File

@ -1,11 +0,0 @@
# ---> Ansible
*.retry
plugins
library
# ---> Python
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

15
.later.yml
View File

@ -1,15 +0,0 @@
---
ansible:
custom_modules:
- iptables_raw
- openssl_pkcs12
- proxmox_kvm
- ucr
- corenetworks_dns
- corenetworks_token
rules:
exclude_files:
- "LICENSE*"
- "**/*.md"
- "**/*.ini"

7
.markdownlint.yml
View File

@ -1,7 +0,0 @@
---
default: True
MD013: False
MD041: False
MD024: False
MD004:
style: dash

1
.prettierignore
View File

@ -1 +0,0 @@
LICENSE

47
.woodpecker/docs.yaml
View File

@ -1,47 +0,0 @@
---
when:
- event: [pull_request]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
steps:
- name: generate
image: quay.io/thegeeklab/ansible-doctor
environment:
ANSIBLE_DOCTOR_EXCLUDE_FILES: molecule/
ANSIBLE_DOCTOR_FORCE_OVERWRITE: "true"
ANSIBLE_DOCTOR_LOG_LEVEL: INFO
ANSIBLE_DOCTOR_ROLE_NAME: ${CI_REPO_NAME}
ANSIBLE_DOCTOR_TEMPLATE: readme
- name: format
image: quay.io/thegeeklab/alpine-tools
commands:
- prettier -w README.md
- name: diff
image: quay.io/thegeeklab/alpine-tools
commands:
- git diff --color=always README.md
- name: publish
image: quay.io/thegeeklab/wp-git-action
settings:
action:
- commit
- push
author_email: ci-bot@rknet.org
author_name: ci-bot
branch: main
message: "[skip ci] automated docs update"
netrc_machine: gitea.rknet.org
netrc_password:
from_secret: gitea_token
when:
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
depends_on:
- test

30
.woodpecker/lint.yaml
View File

@ -1,30 +0,0 @@
---
when:
- event: [pull_request, tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
steps:
- name: ansible-later
image: quay.io/thegeeklab/ansible-later:4
commands:
- ansible-later
environment:
FORCE_COLOR: "1"
- name: python-format
image: docker.io/python:3.12
commands:
- pip install -qq ruff
- ruff format --check --diff .
environment:
PY_COLORS: "1"
- name: python-lint
image: docker.io/python:3.12
commands:
- pip install -qq ruff
- ruff .
environment:
PY_COLORS: "1"

26
.woodpecker/notify.yml
View File

@ -1,26 +0,0 @@
---
when:
- event: [tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
runs_on: [success, failure]
steps:
- name: matrix
image: quay.io/thegeeklab/wp-matrix
settings:
homeserver:
from_secret: matrix_homeserver
password:
from_secret: matrix_password
roomid:
from_secret: matrix_roomid
username:
from_secret: matrix_username
when:
- status: [success, failure]
depends_on:
- docs

25
.woodpecker/test.yaml
View File

@ -1,25 +0,0 @@
---
when:
- event: [pull_request, tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
variables:
- &molecule_base
image: quay.io/thegeeklab/molecule:6
group: molecule
secrets:
- source: molecule_hcloud_token
target: HCLOUD_TOKEN
environment:
PY_COLORS: "1"
steps:
- name: molecule-default
<<: *molecule_base
commands:
- molecule test -s default
depends_on:
- lint

21
LICENSE
View File

@ -1,21 +0,0 @@
MIT License
Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished
to do so, subject to the following conditions:
The above copyright notice and this permission notice (including the next
paragraph) shall be included in all copies or substantial portions of the
Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

60
defaults/main.yml
View File

@ -1,60 +0,0 @@
---
sudo_packages:
- sudo
sudo_logfile: /var/log/sudo.log
sudo_misc_settings:
- "!visiblepw"
- always_set_home
- env_reset
- use_pty
sudo_env_keep:
- COLORS
- DISPLAY
- HOSTNAME
- HISTSIZE
- INPUTRC
- KDEDIR
- LS_COLORS
- MAIL
- PS1
- PS2
- QTDIR
- USERNAME
- LANG
- LC_ADDRESS
- LC_CTYPE
- LC_COLLATE
- LC_IDENTIFICATION
- LC_MEASUREMENT
- LC_MESSAGES
- LC_MONETARY
- LC_NAME
- LC_NUMERIC
- LC_PAPER
- LC_TELEPHONE
- LC_TIME
- LC_ALL
- LANGUAGE
- LINGUAS
- _XKB_CHARSET
- XAUTHORITY
sudo_aliases: []
# @var sudo_aliases:example: >
# sudo_aliases:
# - name: os_admin
# user_aliases:
# - name: admins
# value:
# - my_admin
# cmnd_aliases:
# - name:
# value:
# specs:
# - ADMINS ALL= NOPASSWD:ALL
# @end
sudo_secure_path: /sbin:/bin:/usr/sbin:/usr/bin

27
README.md → index.md
View File

@ -1,13 +1,14 @@
# xoxys.sudo
---
title: sudo
type: docs
---
[![Build Status](https://ci.rknet.org/api/badges/ansible/xoxys.sudo/status.svg)](https://ci.rknet.org/repos/ansible/xoxys.sudo)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?label=license)](https://gitea.rknet.org/ansible/xoxys.sudo/src/branch/main/LICENSE)
[![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.sudo) [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.sudo?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.sudo) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/ansible/xoxys.sudo/src/branch/main/LICENSE)
Configure sudoers environment.
## Table of content
<!--more-->
- [Requirements](#requirements)
- [Default Variables](#default-variables)
- [sudo_aliases](#sudo_aliases)
- [sudo_env_keep](#sudo_env_keep)
@ -16,15 +17,9 @@ Configure sudoers environment.
- [sudo_packages](#sudo_packages)
- [sudo_secure_path](#sudo_secure_path)
- [Dependencies](#dependencies)
- [License](#license)
- [Author](#author)
---
## Requirements
- Minimum Ansible version: `2.10`
## Default Variables
### sudo_aliases
@ -126,14 +121,8 @@ sudo_packages:
sudo_secure_path: /sbin:/bin:/usr/sbin:/usr/bin
```
## Dependencies
None.
## License
MIT
## Author
[Robert Kaussow](https://gitea.rknet.org/xoxys)

25
meta/main.yml
View File

@ -1,25 +0,0 @@
---
galaxy_info:
# @meta author:value: [Robert Kaussow](https://gitea.rknet.org/xoxys)
author: Robert Kaussow <mail@thegeeklab.de>
namespace: xoxys
role_name: sudo
# @meta description: >
# [![Build Status](https://ci.rknet.org/api/badges/ansible/xoxys.sudo/status.svg)](https://ci.rknet.org/repos/ansible/xoxys.sudo)
# [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?label=license)](https://gitea.rknet.org/ansible/xoxys.sudo/src/branch/main/LICENSE)
#
# Configure sudoers environment.
# @end
description: Configure sudoers environment
license: MIT
min_ansible_version: "2.10"
platforms:
- name: EL
versions:
- "9"
galaxy_tags:
- sudo
- security
dependencies: []
collections:
- community.general

5
molecule/default/converge.yml
View File

@ -1,5 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: xoxys.sudo

17
molecule/default/molecule.yml
View File

@ -1,17 +0,0 @@
---
driver:
name: molecule_hetznercloud
dependency:
name: galaxy
options:
role-file: molecule/requirements.yml
requirements-file: molecule/requirements.yml
platforms:
- name: "rocky9-sudo"
server_type: "cx11"
image: "rocky-9"
provisioner:
name: ansible
log: False
verifier:
name: testinfra

11
molecule/default/prepare.yml
View File

@ -1,11 +0,0 @@
---
- name: Prepare
hosts: all
gather_facts: False
tasks:
- name: Bootstrap Python for Ansible
ansible.builtin.raw: |
command -v python3 python ||
((test -e /usr/bin/apt && (apt -y update && apt install -y python-minimal)) ||
echo "Warning: Python not boostrapped due to unknown platform.")
changed_when: False

24
molecule/default/tests/test_default.py
View File

@ -1,24 +0,0 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ["MOLECULE_INVENTORY_FILE"]
).get_hosts("all")
def test_sudoers_file(host):
sudoers = host.file("/etc/sudoers")
assert sudoers.exists
assert sudoers.user == "root"
assert sudoers.group == "root"
assert sudoers.mode == 0o440
def test_sudoers_content(host):
sudoers = host.file("/etc/sudoers")
assert sudoers.contains("/sbin:/bin:/usr/sbin:/usr/bin")
assert sudoers.contains("!visiblepw")
assert sudoers.contains("XAUTHORITY")

4
molecule/requirements.yml
View File

@ -1,4 +0,0 @@
---
collections: []
roles: []

17
pyproject.toml
View File

@ -1,17 +0,0 @@
[tool.ruff]
exclude = [".git", "__pycache__"]
line-length = 99
indent-width = 4
[tool.ruff.lint]
ignore = ["W191", "E111", "E114", "E117", "S101", "S105"]
select = ["F", "E", "I", "W", "S"]
[tool.ruff.format]
quote-style = "double"
indent-style = "space"
line-ending = "lf"
[tool.pytest.ini_options]
filterwarnings = ["ignore::FutureWarning", "ignore::DeprecationWarning"]

30
tasks/main.yml
View File

@ -1,30 +0,0 @@
---
- name: Install requirements
ansible.builtin.package:
name: "{{ item }}"
state: present
loop: "{{ sudo_packages }}"
- name: Add base sudo config
ansible.builtin.template:
src: etc/sudoers.j2
dest: /etc/sudoers
owner: root
group: root
mode: "0440"
validate: "/usr/sbin/visudo -cf %s"
- name: Add config files to sudoers.d
ansible.builtin.template:
src: etc/sudoers.d/sudo_ext.j2
dest: "/etc/sudoers.d/{{ item.name }}"
owner: root
group: root
mode: "0440"
validate: "/usr/sbin/visudo -cf %s"
loop: "{{ sudo_aliases }}"
loop_control:
label: "{{ item.name }}"
when:
- sudo_aliases is defined
- item.user_aliases is defined

19
templates/etc/sudoers.d/sudo_ext.j2
View File

@ -1,19 +0,0 @@
#jinja2: lstrip_blocks: True
{{ ansible_managed | comment }}
{% if item.user_aliases is defined %}
{% for user in item.user_aliases %}
User_Alias {{ user.name | upper }} = {{ user.value | join(', ') }}
{% endfor %}
{% endif %}
{% if item.cmnd_aliases is defined %}
{% for cmnd in item.cmnd_aliases %}
Cmnd_Alias {{ cmnd.name | upper }} = {{ cmnd.value | join(', ') }}
{% endfor %}
{% endif %}
{% if item.specs is defined %}
{% for spec in item.specs %}
{{ spec }}
{% endfor %}
{% endif %}

20
templates/etc/sudoers.j2
View File

@ -1,20 +0,0 @@
#jinja2: lstrip_blocks: True
{{ ansible_managed | comment }}
{% if sudo_misc_settings %}
{% for item in sudo_misc_settings %}
Defaults {{ item }}
{% endfor %}
{% endif %}
{% if sudo_env_keep -%}
Defaults env_keep="{{ sudo_env_keep|join(' ') }}"
{% endif %}
{% if sudo_secure_path -%}
Defaults secure_path="{{ sudo_secure_path }}"
{% endif %}
Defaults logfile={{ sudo_logfile }}
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d