feat: Base rainbowsheep-cloud ansible playbooks and roles

create-user.yml

@@ -0,0 +1,65 @@
+- name: Create new Rainbosheep cloud user
+  hosts: server
+  tasks:
+    - name: Create kerberos user
+      ansible.builtin.command:
+        cmd: "kadmin.local add_principal -pw '{{ password }}' {{ username }}"
+      register: create_krb_user_out
+      failed_when: create_krb_user_out.rc != 0 and create_krb_user_out.rc != 1
+      changed_when: create_krb_user_out.rc == 0
+
+    - name: Create linux group
+      ansible.builtin.group:
+        name: "{{ username }}"
+
+    - name: Create linux user
+      ansible.builtin.user:
+        name: "{{ username }}"
+        create_home: false
+        group: "{{ username }}"
+
+    - name: Create user protected repository
+      ansible.builtin.file:
+        path: "/srv/protected/{{ username }}"
+        state: directory
+        owner: "{{ username }}"
+        group: "{{ username }}"
+        mode: "770"
+
+    - name: Create user vault repository
+      ansible.builtin.file:
+        path: "/srv/vault/{{ username }}"
+        state: directory
+        owner: "{{ username }}"
+        group: "{{ username }}"
+        mode: "770"
+
+    - name: Init gocryptfs vault
+      ansible.builtin.command:
+        cmd: "gocryptfs --init /srv/vault/{{ username }}"
+        stdin: "{{ password }}\n"
+      register: gocryptfs_out
+      failed_when: gocryptfs_out.rc != 0 and gocryptfs_out.rc != 6
+      changed_when: gocryptfs_out.rc == 0
+
+    - name: Get gocryptfs master key
+      ansible.builtin.command:
+        cmd: "gocryptfs-xray -dumpmasterkey /srv/vault/{{ username }}/gocryptfs.conf"
+        stdin: "{{ password }}\n"
+      register: master_key
+
+    - name: Print master key
+      ansible.builtin.debug:
+        msg: |
+          Your master key is:
+
+            {{ master_key.stdout }}
+
+          If the gocryptfs.conf file becomes corrupted or you ever forget your password,
+          there is only one hope for recovery: The master key. Print it to a piece of
+          paper and store it in a drawer.
+
+    - name: Log master key
+      ansible.builtin.debug:
+        msg: "{{ gocryptfs_out }}"
+