Sandwich
ac4f689d51
- Make timezone, locale, and keymap configurable via system_cfg - Consolidate rhel8/9/10.repo.j2 into single rhel.repo.j2 template - Extract bootstrap_common_conditional for shared firewall/LUKS/guest packages - Remove redundant version aliases (fedora40-43, debian10-13, rhel8-10, etc.) - Simplify bootstrap dispatch from 10 conditional blocks to single mapping - Merge bootstrap_ubuntu_lts into bootstrap_ubuntu (identical) - Remove orphaned firstrun.sh.j2 template - Remove configuration/defaults/main.yml aliases, inline into banner.yml - Remove unnecessary changed_when: false on set_fact/debug tasks - Deduplicate hostname variable computation in locales.yml - Update README with timezone/locale/keymap variable reference Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
---
|
|
- name: Configure MOTD
|
|
when: system_cfg.features.banner.motd | bool
|
|
block:
|
|
- name: Create MOTD file
|
|
ansible.builtin.copy:
|
|
content: |
|
|
********************************************************************
|
|
* AUTHORIZED ACCESS ONLY. ALL ACTIVITIES ARE MONITORED AND LOGGED. *
|
|
********************************************************************
|
|
dest: /mnt/etc/motd
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Remove other MOTD files
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /mnt/etc/motd.d/99-motd
|
|
- /mnt/etc/motd.d/cockpit
|
|
- /mnt/etc/motd.d/insights-client
|
|
failed_when: false
|
|
|
|
- name: Configure sudo banner
|
|
when: system_cfg.features.banner.sudo | bool
|
|
block:
|
|
- name: Create sudoers banner directory
|
|
ansible.builtin.file:
|
|
path: /mnt/etc/sudoers.d
|
|
state: directory
|
|
mode: "0755"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Create sudo banner file
|
|
ansible.builtin.copy:
|
|
content: |
|
|
I am Groot, and I know what I'm doing.
|
|
dest: /mnt/etc/sudoers.d/banner
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Enable sudo banner in sudoers
|
|
ansible.builtin.lineinfile:
|
|
path: /mnt/etc/sudoers
|
|
line: "Defaults lecture=@/etc/sudoers.d/banner"
|
|
state: present
|
|
create: true
|
|
mode: "0440"
|
|
owner: root
|
|
group: root
|
|
validate: "visudo -cf - %s"
|