From e6a70d69c5951c5cb2c58ad5fbfe5d15fb2d319d Mon Sep 17 00:00:00 2001 From: Robert Kaussow Date: Mon, 19 Aug 2024 16:06:19 +0200 Subject: [PATCH] refctor: rework ci to ue ansible-lint and fix molecule --- .later.yml | 15 --------------- .woodpecker/docs.yaml | 10 +++++----- .woodpecker/lint.yaml | 6 +++--- .woodpecker/test.yaml | 2 +- .yamllint | 20 ++++++++++++++++++++ meta/main.yml | 2 -- molecule/default/molecule.yml | 6 +++--- molecule/requirements.yml | 4 ---- requirements.yml | 6 ++++++ tasks/main.yml | 24 +++++++++++++++++++----- tasks/users_default.yml | 2 +- tasks/users_keys.yml | 11 ----------- tasks/users_univention.yml | 2 +- 13 files changed, 59 insertions(+), 51 deletions(-) delete mode 100644 .later.yml create mode 100644 .yamllint delete mode 100644 molecule/requirements.yml create mode 100644 requirements.yml delete mode 100644 tasks/users_keys.yml diff --git a/.later.yml b/.later.yml deleted file mode 100644 index 2703cb9..0000000 --- a/.later.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- -ansible: - custom_modules: - - iptables_raw - - openssl_pkcs12 - - proxmox_kvm - - ucr - - corenetworks_dns - - corenetworks_token - -rules: - exclude_files: - - "LICENSE*" - - "**/*.md" - - "**/*.ini" diff --git a/.woodpecker/docs.yaml b/.woodpecker/docs.yaml index f053ca8..857444b 100644 --- a/.woodpecker/docs.yaml +++ b/.woodpecker/docs.yaml @@ -9,11 +9,11 @@ steps: - name: generate image: quay.io/thegeeklab/ansible-doctor environment: - ANSIBLE_DOCTOR_EXCLUDE_FILES: molecule/ - ANSIBLE_DOCTOR_FORCE_OVERWRITE: "true" - ANSIBLE_DOCTOR_LOG_LEVEL: INFO - ANSIBLE_DOCTOR_ROLE_NAME: ${CI_REPO_NAME} - ANSIBLE_DOCTOR_TEMPLATE: readme + ANSIBLE_DOCTOR_EXCLUDE_FILES: "['molecule/']" + ANSIBLE_DOCTOR_RENDERER__FORCE_OVERWRITE: "true" + ANSIBLE_DOCTOR_LOGGING__LEVEL: info + ANSIBLE_DOCTOR_ROLE__NAME: ${CI_REPO_NAME} + ANSIBLE_DOCTOR_TEMPLATE__NAME: readme - name: format image: quay.io/thegeeklab/alpine-tools diff --git a/.woodpecker/lint.yaml b/.woodpecker/lint.yaml index 36b1ec8..c48a8e4 100644 --- a/.woodpecker/lint.yaml +++ b/.woodpecker/lint.yaml @@ -6,10 +6,10 @@ when: - ${CI_REPO_DEFAULT_BRANCH} steps: - - name: ansible-later - image: quay.io/thegeeklab/ansible-later:4 + - name: ansible-lint + image: quay.io/thegeeklab/ansible-dev-tools:1 commands: - - ansible-later + - ansible-lint environment: FORCE_COLOR: "1" diff --git a/.woodpecker/test.yaml b/.woodpecker/test.yaml index 256ad91..661dc8b 100644 --- a/.woodpecker/test.yaml +++ b/.woodpecker/test.yaml @@ -7,7 +7,7 @@ when: variables: - &molecule_base - image: quay.io/thegeeklab/molecule:6 + image: quay.io/thegeeklab/ansible-dev-tools:1 group: molecule environment: PY_COLORS: "1" diff --git a/.yamllint b/.yamllint new file mode 100644 index 0000000..df1d39e --- /dev/null +++ b/.yamllint @@ -0,0 +1,20 @@ +--- +extends: default + +rules: + truthy: + allowed-values: ["True", "False"] + comments: + min-spaces-from-content: 1 + comments-indentation: False + line-length: disable + braces: + min-spaces-inside: 0 + max-spaces-inside: 1 + brackets: + min-spaces-inside: 0 + max-spaces-inside: 0 + indentation: enable + octal-values: + forbid-implicit-octal: True + forbid-explicit-octal: True diff --git a/meta/main.yml b/meta/main.yml index 9967898..dcb2f2f 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -20,5 +20,3 @@ galaxy_info: galaxy_tags: - user dependencies: [] -collections: - - community.general diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml index d1c0d56..87abb49 100644 --- a/molecule/default/molecule.yml +++ b/molecule/default/molecule.yml @@ -4,11 +4,11 @@ driver: dependency: name: galaxy options: - role-file: molecule/requirements.yml - requirements-file: molecule/requirements.yml + role-file: requirements.yml + requirements-file: requirements.yml platforms: - name: "rocky9-users" - server_type: "CX22" + server_type: "cx22" image: "rocky-9" provisioner: name: ansible diff --git a/molecule/requirements.yml b/molecule/requirements.yml deleted file mode 100644 index 5b676bf..0000000 --- a/molecule/requirements.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -collections: [] - -roles: [] diff --git a/requirements.yml b/requirements.yml new file mode 100644 index 0000000..6731828 --- /dev/null +++ b/requirements.yml @@ -0,0 +1,6 @@ +--- +collections: + - name: community.general + - name: ansible.posix + +roles: [] diff --git a/tasks/main.yml b/tasks/main.yml index 0565609..1c394f6 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,5 +1,6 @@ --- -- ansible.builtin.include_vars: "{{ lookup('first_found', params) }}" +- name: Include OS specific vars + ansible.builtin.include_vars: "{{ lookup('first_found', params) }}" vars: params: files: @@ -8,9 +9,12 @@ paths: - "vars" errors: "ignore" -- ansible.builtin.include_tasks: security.yml -- ansible.builtin.include_tasks: bash.yml -- ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}" +- name: Ensure secure defaults + ansible.builtin.include_tasks: security.yml +- name: Configure bash + ansible.builtin.include_tasks: bash.yml +- name: Configure users + ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}" vars: params: files: @@ -19,4 +23,14 @@ - "users_default.yml" paths: - "tasks" -- ansible.builtin.include_tasks: users_keys.yml + +- name: Set authorized_key for ssh users + ansible.posix.authorized_key: + user: "{{ item.name }}" + key: "{{ item.sshkeys }}" + exclusive: True + state: present + loop: "{{ users_default_users }}" + loop_control: + label: "{{ item.name }}" + when: item.sshkeys is defined diff --git a/tasks/users_default.yml b/tasks/users_default.yml index ae99469..6a07c18 100644 --- a/tasks/users_default.yml +++ b/tasks/users_default.yml @@ -10,7 +10,7 @@ name: "{{ item.name }}" groups: "{{ item.groups | default([]) | join(',') or omit }}" append: "{{ True if (item.groups | default([]) | length > 0) else False }}" - password: "{{ item.password | password_hash('sha512',65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}" + password: "{{ item.password | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}" password_expire_min: "{{ item.password_expire_min | default(users_pass_min_day) }}" shell: "{{ item.shell | default('/bin/bash') }}" loop: "{{ users_default_users }}" diff --git a/tasks/users_keys.yml b/tasks/users_keys.yml deleted file mode 100644 index 5fb95d9..0000000 --- a/tasks/users_keys.yml +++ /dev/null @@ -1,11 +0,0 @@ ---- -- name: Set authorized_key for ssh users - ansible.posix.authorized_key: - user: "{{ item.name }}" - key: "{{ item.sshkeys }}" - exclusive: True - state: present - loop: "{{ users_default_users }}" - loop_control: - label: "{{ item.name }}" - when: item.sshkeys is defined diff --git a/tasks/users_univention.yml b/tasks/users_univention.yml index 78162ae..0b2bf1c 100644 --- a/tasks/users_univention.yml +++ b/tasks/users_univention.yml @@ -13,7 +13,7 @@ name: "{{ item.name }}" groups: "{{ item.groups | default([]) | join(',') or omit }}" append: "{{ True if (item.groups | default([]) | length > 0) else False }}" - password: "{{ item.password | password_hash('sha512',65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}" + password: "{{ item.password | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) if item.password is defined else '*' }}" password_expire_min: "{{ item.password_expire_min | default(users_pass_min_day) }}" shell: "{{ item.shell | default('/bin/bash') }}" system: "yes"