65 lines
2 KiB
YAML
65 lines
2 KiB
YAML
- name: Create new Rainbosheep cloud user
|
|
hosts: server
|
|
tasks:
|
|
- name: Create kerberos user
|
|
ansible.builtin.command:
|
|
cmd: "kadmin.local add_principal -pw '{{ password }}' {{ username }}"
|
|
register: create_krb_user_out
|
|
failed_when: create_krb_user_out.rc != 0 and create_krb_user_out.rc != 1
|
|
changed_when: create_krb_user_out.rc == 0
|
|
|
|
- name: Create linux group
|
|
ansible.builtin.group:
|
|
name: "{{ username }}"
|
|
|
|
- name: Create linux user
|
|
ansible.builtin.user:
|
|
name: "{{ username }}"
|
|
create_home: false
|
|
group: "{{ username }}"
|
|
|
|
- name: Create user protected repository
|
|
ansible.builtin.file:
|
|
path: "/srv/protected/{{ username }}"
|
|
state: directory
|
|
owner: "{{ username }}"
|
|
group: "{{ username }}"
|
|
mode: "770"
|
|
|
|
- name: Create user vault repository
|
|
ansible.builtin.file:
|
|
path: "/srv/vault/{{ username }}"
|
|
state: directory
|
|
owner: "{{ username }}"
|
|
group: "{{ username }}"
|
|
mode: "770"
|
|
|
|
- name: Init gocryptfs vault
|
|
ansible.builtin.command:
|
|
cmd: "gocryptfs --init /srv/vault/{{ username }}"
|
|
stdin: "{{ password }}\n"
|
|
register: gocryptfs_out
|
|
failed_when: gocryptfs_out.rc != 0 and gocryptfs_out.rc != 6
|
|
changed_when: gocryptfs_out.rc == 0
|
|
|
|
- name: Get gocryptfs master key
|
|
ansible.builtin.command:
|
|
cmd: "gocryptfs-xray -dumpmasterkey /srv/vault/{{ username }}/gocryptfs.conf"
|
|
stdin: "{{ password }}\n"
|
|
register: master_key
|
|
|
|
- name: Print master key
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Your master key is:
|
|
|
|
{{ master_key.stdout }}
|
|
|
|
If the gocryptfs.conf file becomes corrupted or you ever forget your password,
|
|
there is only one hope for recovery: The master key. Print it to a piece of
|
|
paper and store it in a drawer.
|
|
|
|
- name: Log master key
|
|
ansible.builtin.debug:
|
|
msg: "{{ gocryptfs_out }}"
|
|
|