sandwich/Ansible-Bootstrap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(configuration): grant the platform sudo group only when sudo is set

Browse Source
This commit is contained in:
Sandwich
2026-07-14 01:48:26 +02:00
parent 371d5a0acd
commit 1c00ec9370
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
roles/configuration/tasks/users.yml
View File

@@ -26,17 +26,22 @@
- name: Create user accounts - name: Create user accounts
vars: vars:
configuration_user_group: "{{ _configuration_platform.user_group }}"
# plaintext is hashed; a pre-computed crypt hash ($6$/$y$/...) passes through. # plaintext is hashed; a pre-computed crypt hash ($6$/$y$/...) passes through.
configuration_user_pw: >- configuration_user_pw: >-
{{ item.value.password if (item.value.password | string)[:1] == '$' {{ item.value.password if (item.value.password | string)[:1] == '$'
else item.value.password | password_hash('sha512') }} else item.value.password | password_hash('sha512') }}
configuration_user_groups: >-
{{ item.value.groups | default(
[_configuration_platform.user_group]
if (item.value.sudo | default(false)) not in [false, '', none]
else []) }}
configuration_useradd_cmd: >- configuration_useradd_cmd: >-
{{ chroot_command }} /usr/sbin/useradd --create-home --user-group {{ chroot_command }} /usr/sbin/useradd --create-home --user-group
--uid {{ 1000 + _idx }} --uid {{ 1000 + _idx }}
--groups {{ configuration_user_group }} {{ item.key }} {{ ('--groups ' ~ (configuration_user_groups | join(','))) if (configuration_user_groups | length) > 0 else '' }}
{{ ('--password ' ~ configuration_user_pw) if (item.value.password | default('') | string | length > 0) else '' }} {{ ('--password ' ~ configuration_user_pw) if (item.value.password | default('') | string | length > 0) else '' }}
--shell {{ item.value.shell | default('/bin/bash') }} --shell {{ item.value.shell | default('/bin/bash') }}
{{ item.key }}
ansible.builtin.command: "{{ configuration_useradd_cmd }}" ansible.builtin.command: "{{ configuration_useradd_cmd }}"
loop: "{{ system_cfg.users | dict2items }}" loop: "{{ system_cfg.users | dict2items }}"
loop_control: loop_control: