initial commit
Some checks failed
continuous-integration/drone/push Build is failing

This commit is contained in:
Robert Kaussow 2019-11-03 18:19:53 +01:00
commit 9b1612e356
24 changed files with 707 additions and 0 deletions

148
.drone.jsonnet Normal file
View File

@ -0,0 +1,148 @@
local PipelineLinting = {
kind: "pipeline",
name: "linting",
platform: {
os: "linux",
arch: "amd64",
},
steps: [
{
name: "ansible-later",
image: "xoxys/ansible-later:latest",
environment: {
PY_COLORS: 1
},
commands: [
"git clone https://gitea.rknet.org/ansible/ansible-later-policy.git ~/policy",
"ansible-later -c ~/policy/config.yml"
],
},
],
trigger: {
ref: ["refs/heads/master", "refs/tags/**", "refs/pull/**"],
},
};
local PipelineDeployment = {
kind: "pipeline",
name: "deployment",
platform: {
os: "linux",
arch: "amd64",
},
concurrency: {
limit: 1
},
workspace: {
base: "/drone/src",
path: "xoxys.users"
},
steps: [
{
name: "ansible-molecule",
image: "xoxys/molecule:do-linux-amd64",
environment: {
DO_API_KEY: { "from_secret": "do_api_key" },
USER: "root",
MOLECULE_CUSTOM_MODULES_REPO: "https://gitea.rknet.org/ansible/custom_modules",
MOLECULE_CUSTOM_FILTERS_REPO: "https://gitea.rknet.org/ansible/custom_filters",
PY_COLORS: 1
},
commands: [
"/bin/bash /docker-entrypoint.sh",
"molecule test -s default",
],
},
],
depends_on: [
"linting",
],
trigger: {
ref: ["refs/heads/master", "refs/tags/**"],
},
};
local PipelineDocumentation = {
kind: "pipeline",
name: "documentation",
platform: {
os: "linux",
arch: "amd64",
},
steps: [
{
name: "ansible-doctor",
image: "xoxys/ansible-doctor:latest",
environment: {
ANSIBLE_DOCTOR_LOG_LEVEL: "INFO",
ANSIBLE_DOCTOR_FORCE_OVERWRITE: true,
ANSIBLE_DOCTOR_EXCLUDE_FILES: "molecule/",
ANSIBLE_DOCTOR_CUSTOM_HEADER: "HEADER.md",
PY_COLORS: 1
},
},
{
name: "push-to-repo",
image: "plugins/git-action:latest",
settings: {
actions: ["commit", "push"],
author_email: "shipper@rknet.org",
author_name: "DroneShipper",
branch: "master",
message: "[SKIP CI] update readme",
remote: "https://gitea.rknet.org/ansible/xoxys.users",
netrc_machine: "gitea.rknet.org",
netrc_username: {"from_secret": "gitea_username"},
netrc_password: {"from_secret": "gitea_token"},
},
when: {
ref: ["refs/heads/master"],
},
},
],
depends_on: [
"deployment",
],
trigger: {
ref: ["refs/heads/master", "refs/tags/**", "refs/pull/**"],
},
};
local PipelineNotification= {
kind: "pipeline",
name: "notification",
platform: {
os: "linux",
arch: "amd64",
},
clone: {
disable: true,
},
steps: [
{
name: "matrix",
image: "plugins/matrix",
settings: {
homeserver: { "from_secret": "matrix_homeserver" },
roomid: { "from_secret": "matrix_roomid" },
template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}",
username: { "from_secret": "matrix_username" },
password: { "from_secret": "matrix_password" },
},
},
],
depends_on: [
"documentation",
],
trigger: {
status: [ "success", "failure" ],
ref: ["refs/heads/master", "refs/tags/**"],
},
};
[
PipelineLinting,
PipelineDeployment,
PipelineDocumentation,
PipelineNotification,
]

148
.drone.yml Normal file
View File

@ -0,0 +1,148 @@
---
kind: pipeline
name: linting
platform:
os: linux
arch: amd64
steps:
- name: ansible-later
image: xoxys/ansible-later:latest
commands:
- git clone https://gitea.rknet.org/ansible/ansible-later-policy.git ~/policy
- ansible-later -c ~/policy/config.yml
environment:
PY_COLORS: 1
trigger:
ref:
- refs/heads/master
- refs/tags/**
- refs/pull/**
---
kind: pipeline
name: deployment
platform:
os: linux
arch: amd64
concurrency:
limit: 1
workspace:
base: /drone/src
path: xoxys.users
steps:
- name: ansible-molecule
image: xoxys/molecule:do-linux-amd64
commands:
- /bin/bash /docker-entrypoint.sh
- molecule test -s default
environment:
DO_API_KEY:
from_secret: do_api_key
MOLECULE_CUSTOM_FILTERS_REPO: https://gitea.rknet.org/ansible/custom_filters
MOLECULE_CUSTOM_MODULES_REPO: https://gitea.rknet.org/ansible/custom_modules
PY_COLORS: 1
USER: root
trigger:
ref:
- refs/heads/master
- refs/tags/**
depends_on:
- linting
---
kind: pipeline
name: documentation
platform:
os: linux
arch: amd64
steps:
- name: ansible-doctor
image: xoxys/ansible-doctor:latest
environment:
ANSIBLE_DOCTOR_CUSTOM_HEADER: HEADER.md
ANSIBLE_DOCTOR_EXCLUDE_FILES: molecule/
ANSIBLE_DOCTOR_FORCE_OVERWRITE: true
ANSIBLE_DOCTOR_LOG_LEVEL: INFO
PY_COLORS: 1
- name: push-to-repo
image: plugins/git-action:latest
settings:
actions:
- commit
- push
author_email: shipper@rknet.org
author_name: DroneShipper
branch: master
message: "[SKIP CI] update readme"
netrc_machine: gitea.rknet.org
netrc_password:
from_secret: gitea_token
netrc_username:
from_secret: gitea_username
remote: https://gitea.rknet.org/ansible/xoxys.users
when:
ref:
- refs/heads/master
trigger:
ref:
- refs/heads/master
- refs/tags/**
- refs/pull/**
depends_on:
- deployment
---
kind: pipeline
name: notification
platform:
os: linux
arch: amd64
clone:
disable: true
steps:
- name: matrix
image: plugins/matrix
settings:
homeserver:
from_secret: matrix_homeserver
password:
from_secret: matrix_password
roomid:
from_secret: matrix_roomid
template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}"
username:
from_secret: matrix_username
trigger:
ref:
- refs/heads/master
- refs/tags/**
status:
- success
- failure
depends_on:
- documentation
---
kind: signature
hmac: 98e77b48006b6b5076441910ee51500852d8e47f484d6826deb24f7ca1ab287e
...

11
.gitignore vendored Normal file
View File

@ -0,0 +1,11 @@
# ---> Ansible
*.retry
plugins
library
# ---> Python
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

4
HEADER.md Normal file
View File

@ -0,0 +1,4 @@
# xoxys.users
[![Build Status](https://drone.rknet.org/api/badges/ansible/xoxys.users/status.svg)](https://drone.rknet.org/ansible/xoxys.users)

8
LICENSE Normal file
View File

@ -0,0 +1,8 @@
MIT License
Copyright (c) <year> <copyright holders>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

2
README.md Normal file
View File

@ -0,0 +1,2 @@
# xoxys.users

26
defaults/main.yml Normal file
View File

@ -0,0 +1,26 @@
---
users_default_users: []
# @var users_default_users:example: >
# users_default_users:
# - name: admin
# groups:
# - wheel
# password: "secure"
# key: "ssh-ed25519 AAAA..."
# shell: /bin/bash
# @end
users_default_groups: []
users_global_bash_aliases:
- alias: "ll"
command: "ls -lh"
- alias: "la"
command: "ls -lha"
users_bash_bashrc_overrides: []
# @var users_bash_bashrc_overrides:example: >
# users_bash_bashrc_overrides:
# - /etc/skel/.bashrc
# - /root/.bashrc
# @end

13
meta/main.yml Normal file
View File

@ -0,0 +1,13 @@
# Standards: 0.1
---
galaxy_info:
author: xoxys
description:
license: MIT
min_ansible_version: 2.4
platforms:
- name: EL
versions:
- 7
galaxy_tags:
dependencies:

View File

@ -0,0 +1,87 @@
---
- name: Create
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
vars:
ssh_user: root
ssh_port: 22
keypair_name: molecule_key
keypair_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/ssh_key"
tasks:
- name: Create local keypair
user:
name: "{{ lookup('env', 'USER') }}"
generate_ssh_key: true
ssh_key_file: "{{ keypair_path }}"
register: local_keypair
- name: Create remote keypair
digital_ocean_sshkey:
name: "{{ keypair_name }}"
ssh_pub_key: "{{ local_keypair.ssh_public_key }}"
state: present
register: remote_keypair
- name: Create molecule instance(s)
digital_ocean_droplet:
name: "{{ item.name }}"
unique_name: true
region: "{{ item.region_id }}"
image: "{{ item.image_id }}"
size: "{{ item.size_id }}"
ssh_keys: "{{ remote_keypair.data.ssh_key.id }}"
wait: true
wait_timeout: 300
state: present
register: server
loop: "{{ molecule_yml.platforms }}"
async: 7200
poll: 0
- name: Wait for instance(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config dict
set_fact:
instance_conf_dict: {
'instance': "{{ item.data.droplet.name }}",
'address': "{{ item.data.ip_address }}",
'user': "{{ ssh_user }}",
'port': "{{ ssh_port }}",
'identity_file': "{{ keypair_path }}",
'droplet_id': "{{ item.data.droplet.id }}",
'ssh_key_id': "{{ remote_keypair.data.ssh_key.id }}",
}
loop: "{{ digitalocean_jobs.results }}"
register: instance_config_dict
when: server.changed | bool
- name: Convert instance config dict to a list
set_fact:
instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}"
when: server.changed | bool
- name: Dump instance config
copy:
content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool
- name: Wait for SSH
wait_for:
port: "{{ ssh_port }}"
host: "{{ item.address }}"
search_regex: SSH
delay: 10
timeout: 320
loop: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"

View File

@ -0,0 +1,54 @@
---
- name: Destroy
hosts: localhost
connection: local
gather_facts: false
no_log: "{{ molecule_no_log }}"
tasks:
- block:
- name: Populate instance config
set_fact:
instance_conf: "{{ lookup('file', molecule_instance_config) | molecule_from_yaml }}"
skip_instances: false
rescue:
- name: Populate instance config when file missing
set_fact:
instance_conf: {}
skip_instances: true
- name: Destroy molecule instance(s)
digital_ocean_droplet:
name: "{{ item.instance }}"
id: "{{ item.droplet_id }}"
state: absent
register: server
loop: "{{ instance_conf | flatten(levels=1) }}"
when: not skip_instances
async: 7200
poll: 0
- name: Wait for instance(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: digitalocean_jobs
until: digitalocean_jobs.finished
retries: 300
loop: "{{ server.results }}"
- name: Delete remote keypair
digital_ocean_sshkey:
fingerprint: "{{ item.ssh_key_id }}"
state: absent
loop: "{{ instance_conf | flatten(levels=1) }}"
# Mandatory configuration for Molecule to function.
- name: Populate instance config
set_fact:
instance_conf: {}
- name: Dump instance config
copy:
content: "{{ instance_conf | molecule_to_yaml | molecule_header }}"
dest: "{{ molecule_instance_config }}"
when: server.changed | bool

View File

@ -0,0 +1,24 @@
---
dependency:
name: galaxy
driver:
name: digitalocean
platforms:
- name: centos7-users
region_id: fra1
image_id: centos-7-x64
size_id: s-1vcpu-1gb
lint:
name: yamllint
enabled: False
provisioner:
name: ansible
lint:
name: ansible-lint
enabled: False
verifier:
name: testinfra
lint:
name: flake8
options:
max-line-length: 120

View File

@ -0,0 +1,14 @@
---
- name: Converge
hosts: all
vars:
users_default_users:
- name: demouser
groups:
- wheel
shell: /bin/sh
users_default_groups:
- demogroup
roles:
- role: xoxys.users

View File

@ -0,0 +1,9 @@
---
- name: Prepare
hosts: all
gather_facts: false
tasks:
- name: Install python for Ansible
raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)
become: true
changed_when: false

View File

@ -0,0 +1,21 @@
import os
import testinfra.utils.ansible_runner
import warnings
warnings.filterwarnings("ignore", category=DeprecationWarning)
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_users_create_user(host):
user = host.user("demouser")
assert user.name == "demouser"
assert user.shell == "/bin/sh"
assert "wheel" in user.groups
def test_users_create_group(host):
assert host.group("demogroup").exists

3
molecule/pytest.ini Normal file
View File

@ -0,0 +1,3 @@
[pytest]
filterwarnings =
ignore::DeprecationWarning

18
tasks/bash.yml Normal file
View File

@ -0,0 +1,18 @@
---
- block:
- name: Override default .bashrc for given users
template:
src: etc/bashrc.j2
dest: "{{ item }}"
owner: root
group: root
loop: "{{ users_bash_bashrc_overrides }}"
- name: Setup custom bash profile at '/etc/profile.d/custom.sh'
template:
src: etc/profile.d/custom.sh.j2
dest: /etc/profile.d/custom.sh
owner: root
group: root
become: True
become_user: root

23
tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- include_vars: "{{ lookup('first_found', params) }}"
vars:
params:
files:
- "{{ ansible_lsb.id | default('') | lower }}.yml"
- "{{ ansible_os_family | lower }}.yml"
paths:
- "vars"
errors: "ignore"
- include_tasks: "{{ lookup('first_found', params) }}"
vars:
params:
files:
- "users_{{ ansible_lsb.id | default('') | lower }}.yml"
- "users_{{ ansible_os_family | lower }}.yml"
- "users_default.yml"
paths:
- "tasks"
- include_tasks: users_keys.yml
- include_tasks: bash.yml

20
tasks/users_default.yml Normal file
View File

@ -0,0 +1,20 @@
---
- block:
- name: Create common groups
group:
name: "{{ item }}"
state: present
loop: "{{ users_groups }}"
- name: Create common users
user:
name: "{{ item.name }}"
groups: "{{ item.groups | default([]) | join(',') or omit }}"
append: yes
password: "{{ item.password | default(omit) | password_hash('sha512',65534 | random(seed=inventory_hostname) | string) }}"
shell: "{{ item.shell | default('/bin/bash') }}"
loop: "{{ users_users }}"
loop_control:
label: "{{ item.name }}"
become: True
become_user: root

13
tasks/users_keys.yml Normal file
View File

@ -0,0 +1,13 @@
---
- block:
- name: Set authorized_key for ssh users
authorized_key:
user: "{{ item.name }}"
key: "{{ item.key }}"
state: present
loop: "{{ users_users }}"
loop_control:
label: "{{ item.name }}"
when: item.key is defined
become: True
become_user: root

View File

@ -0,0 +1,24 @@
---
- block:
# use system users and groups to prevent duplicate ids
# this is a workaround because udm_user not working
- name: Create common groups
group:
name: "{{ item }}"
system: 'yes'
state: present
loop: "{{ users_groups }}"
- name: Create common users
user:
name: "{{ item.name }}"
groups: "{{ item.groups | default([]) | join(',') or omit }}"
append: yes
password: "{{ item.password | default(omit) | password_hash('sha512',65534 | random(seed=inventory_hostname) | string) }}"
shell: "{{ item.shell | default('/bin/bash') }}"
system: 'yes'
loop: "{{ users_users }}"
loop_control:
label: "{{ item.name }}"
become: True
become_user: root

17
templates/etc/bashrc.j2 Normal file
View File

@ -0,0 +1,17 @@
#jinja2: lstrip_blocks: True
{{ ansible_managed | comment }}
# Source global definitions
if [ -f {{ __users_bash_system_bashrc }} ]; then
. {{ __users_bash_system_bashrc }}
fi
{% if ansible_os_family | lower == "debian" %}
if [ -f /etc/profile ]; then
. /etc/profile
fi
{% endif %}
# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=
# User specific aliases and functions

View File

@ -0,0 +1,16 @@
#jinja2:lstrip_blocks: True
{{ ansible_managed | comment }}
umask {{ users_default_umask }}
# are we an interactive shell?
if [ "$PS1" ]; then
if [[ ${EUID} == 0 ]] ; then
PS1='\[$(tput bold)\]\[\033[38;5;9m\]\u\[$(tput sgr0)\]\[\033[38;5;15m\]@\h [\w] \$ \[$(tput sgr0)\]'
else
PS1='\[$(tput bold)\]\[\033[38;5;12m\]\u\[$(tput sgr0)\]\[\033[38;5;15m\]@\h [\w] \$ \[$(tput sgr0)\]'
fi
{% for item in users_global_bash_aliases %}
alias {{ item.alias }}='{{ item.command }}'
{% endfor %}
fi

2
vars/debian.yml Normal file
View File

@ -0,0 +1,2 @@
---
__users_bash_system_bashrc: /etc/bash.bashrc

2
vars/redhat.yml Normal file
View File

@ -0,0 +1,2 @@
---
__users_bash_system_bashrc: /etc/bashrc