feat: Base rainbowsheep-cloud ansible playbooks and roles

roles/kerberos/tasks/main.yml

@@ -0,0 +1,76 @@
+- name: Install Kerberos server
+  ansible.builtin.apt:
+    pkg:
+      - krb5-user
+      - krb5-kdc
+      - krb5-admin-server
+    state: present
+    update_cache: yes
+
+- name: Enables krb5-kdc
+  ansible.builtin.service:
+    name: krb5-kdc
+    enabled: true
+
+- name: Enables krb5-admin-server
+  ansible.builtin.service:
+    name: krb5-admin-server
+    enabled: true
+
+- name: Configure krb5
+  ansible.builtin.template:
+    src: krb5.conf.j2
+    dest: /etc/krb5.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart krb5 kdc
+    - Restart krb5 admin server
+
+- name: Configure krb5 kdc
+  ansible.builtin.template:
+    src: kdc.conf.j2
+    dest: /etc/krb5kdc/kdc.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart krb5 kdc
+    - Restart krb5 admin server
+
+- name: Configure krb5 ACLs
+  # Allow */admin (notable root/admin) user to manage principals
+  ansible.builtin.template:
+    src: kadm5.acl.j2
+    dest: /etc/krb5kdc/kadm5.acl
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart krb5 kdc
+    - Restart krb5 admin server
+
+
+- name: Create kdc
+  ansible.builtin.command:
+    cmd: "kdb5_util create -P {{ krb5_master_password }}"
+  register: create_kdc
+  failed_when: create_kdc.rc != 0 and create_kdc.rc != 1
+  changed_when: create_kdc.rc == 0
+
+- name: Create kdc stash file
+  # The stash file is specified in kdc.conf as key_stash_file
+  ansible.builtin.command:
+    cmd: "kdb5_util stash -P {{ krb5_master_password }}"
+
+- name: Start krb5-kdc
+  ansible.builtin.service:
+    name: krb5-kdc
+    state: started
+
+- name: Start krb5-admin-server
+  ansible.builtin.service:
+    name: krb5-admin-server
+    state: started
+