workstation-headless.yml

---
- name: Configure Fedora workstation (headless)
  hosts: workstation-headless
  remote_user: matiss
  vars:
    # Update these variables as needed to match your own settings.
    host_username: 'matiss'
    allow_ssh_users: 'matiss'
    git_email: 'matiss@hub256.com'
    git_name: 'Matīss Treinis'
    git_signing_key: '3B44AE79519B1C6552941B109123B913EBF53D43'
    git_commit_gpgsign: 'true'
    git_diff_tool: 'vimdiff'
    git_push_default: 'current'
    authorized_keys: '{{ lookup("file", "files/id_rsa.pub") }}'
  handlers:
    - name: Restart sshd
      service:
        name: sshd
        state: restarted
      become: yes
    - name: Reload firewalld
      service:
        name: firewalld
        state: reloaded
      become: yes
  tasks:
    - name: Add RPM keys (.rpm repos)
      rpm_key:
        state: present
        key: '{{item}}'
      loop:
        - 'https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-free-fedora-2020'
        - 'https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020'
        - 'https://repo.protonvpn.com/fedora-{{ansible_distribution_major_version}}-stable/public_key.asc'
      become: yes
      tags: [ 'repositories' ]

    - name: Add repositories (.rpm)
      dnf:
        name: '{{ item }}'
        state: present
      loop:
        - 'https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-{{ansible_distribution_major_version}}.noarch.rpm'
        - 'https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-{{ansible_distribution_major_version}}.noarch.rpm'
        - 'https://repo.protonvpn.com/fedora-{{ansible_distribution_major_version}}-stable/protonvpn-stable-release/protonvpn-stable-release-1.0.1-2.noarch.rpm'
      become: yes
      tags: [ 'repositories' ]

    - name: Add repositories (.repo)
      get_url:
        url: '{{item.url}}'
        dest: '/etc/yum.repos.d/{{item.name}}.repo'
      loop:
        - { name: docker-ce, url: 'https://download.docker.com/linux/fedora/docker-ce.repo' }
        - { name: hashicorp, url: 'https://rpm.releases.hashicorp.com/fedora/hashicorp.repo' }
      become: yes
      tags: [ 'repositories' ]

    - name: Enable repositories
      shell: 'dnf config-manager --set-enabled {{item}}'
      loop:
        - docker-ce-stable
        - rpmfusion-free
        - rpmfusion-free-updates
        - rpmfusion-nonfree
        - rpmfusion-nonfree-updates
        - protonvpn-fedora-stable
      become: yes
      tags: [ 'repositories' ]
      changed_when: false

    - name: Install workstation packages
      package:
        name: '{{item}}'
        state: latest
      loop:
        - clang
        - cloud-utils
        - cmake
        - cockpit
        - cockpit-machines
        - containerd.io
        - curl
        - dnsutils
        - docker-buildx-plugin
        - docker-ce
        - docker-ce-cli
        - docker-compose-plugin
        - firewalld
        - fzf
        - git
        - git-extras
        - gnupg
        - guestfs-tools
        - htop
        - libvirt
        - make
        - micro
        - ncdu
        - nmap
        - openvpn
        - pinentry-tty
        - python3
        - python3-pip
        - qemu-img
        - qemu-kvm
        - rubygems
        - terraform
        - tmux
        - traceroute
        - unzip
        - virt-install
        - wget
        - whois
        - zip
        - zsh
      become: yes
      tags: [ 'packages' ]

    - name: Install ffmpeg with allow erasing
      dnf:
        name: ffmpeg
        state: latest
        allowerasing: yes
      become: yes
      tags: [ 'packages' ]

    - name: Install tmuxinator
      gem:
        name: tmuxinator
        state: latest
        user_install: false
      become: yes
      tags: [ 'packages' , 'gem' ]

    - name: Ensure pip3 packages
      pip:
        name: '{{item}}'
        executable: pip3
        state: latest
      loop:
        - ansible # Yo dawg i herd you like Ansible so we put a Ansible in yo Ansible so you can automate while u automate
        - awscli

    - name: Enable and start Docker-CE service
      service:
        name: docker
        state: started
        enabled: yes
      become: yes

    - name: Enable and start libvirtd
      service:
        name: libvirtd
        state: started
        enabled: yes
      become: yes

    - meta: flush_handlers

    - name: Install oh-my-zsh for self
      script:
        cmd: 'scripts/oh-my-zsh-setup.sh --unattended --keep-zshrc'
        chdir: '/home/{{host_username}}'
        creates: '/home/{{host_username}}/.oh-my-zsh'
      changed_when: false # ignore

    - name: Ensure group "docker" exists
      group:
        name: docker
        state: present
      become: yes

    - name: Configure '{{host_username}}' user settings (zsh, docker group)
      user:
        name: '{{host_username}}'
        shell: /bin/zsh
        groups: docker
        append: yes
        create_home: yes
        password: '*' # Initial password is none, account locked
        update_password: on_create # Do not reset password from ansible
      become: yes

    - name: Ensure '/home/{{host_username}}/.ssh/' has correct permissions
      file:
        path: '/home/{{host_username}}/.ssh'
        state: directory
        mode: '0700'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      become: yes

    - name: Locate all files in '/home/{{host_username}}/.ssh/'
      find:
        paths: '/home/{{host_username}}/.ssh'
        file_type: file
        patterns: "*"
      register: home_dot_ssh_files

    - name: Ensure all files in '/home/{{host_username}}/.ssh/' have correct permissions
      file:
        path: '{{ item.path }}'
        state: file
        owner: '{{host_username}}'
        group: '{{host_username}}'
        mode: '0600'
      loop: '{{ home_dot_ssh_files.files }}'
      loop_control:
        label: '{{item.path}}'

    - name: Ensure personal dot files
      copy:
        src: '{{item.src}}'
        dest: '{{item.dest}}'
        mode: '0600'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      loop:
        - { src: dots/zshrc.zsh, dest: '/home/{{host_username}}/.zshrc' }
        - { src: dots/tmux.conf, dest: '/home/{{host_username}}/.tmux.conf' }
        - { src: dots/editorconfig, dest: '/home/{{host_username}}/.editorconfig' }
        - { src: dots/wgetrc, dest: '/home/{{host_username}}/.wgetrc' }
        - { src: dots/gitignore, dest: '/home/{{host_username}}/.gitignore' }
        - { src: dots/curlrc, dest: '/home/{{host_username}}/.curlrc' }
      tags: [ 'dots' ]

    - name: Ensure personal files (from templates)
      template:
        src: '{{item.src}}'
        dest: '{{item.dest}}'
        mode: '0600'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      loop:
        - { src: dots/gitconfig, dest: '/home/{{host_username}}/.gitconfig' }
        - { src: dots/authorized_keys, dest: '/home/{{host_username}}/.ssh/authorized_keys' }

    - name: Ensure default directories in home
      file:
        path: '{{item}}'
        state: directory
        mode: '0700'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      loop:
        - '/home/{{host_username}}/dots'
        - '/home/{{host_username}}/Projects'
        - '/home/{{host_username}}/Projects/Work'
        - '/home/{{host_username}}/Projects/Work/Archive'
        - '/home/{{host_username}}/Projects/Work/Scratch'
        - '/home/{{host_username}}/Projects/Personal'
        - '/home/{{host_username}}/Projects/Personal/Archive'
        - '/home/{{host_username}}/Projects/Personal/Scratch'
        - '/home/{{host_username}}/Documents/Work/Archive'
        - '/home/{{host_username}}/Documents/Personal/Archive'
      become: yes
      tags: [ 'dir-structure' ]

    - meta: flush_handlers

    - name: Ensure local sshd config exists with the right perms
      file:
        path: /etc/ssh/sshd_config.d/00-local.conf
        state: touch
        mode: '0700'
        owner: root
        group: root
        modification_time: preserve
        access_time: preserve
      become: yes
      tags: [ 'sshd' ]

    - name: Set local sshd config
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-local.conf
        regexp: '^{{item.key}}'
        line: '{{item.key}} {{item.value}}'
        state: present
      become: yes
      loop:
        - { key: 'PasswordAuthentication', value: 'no' }
        - { key: 'PermitEmptyPasswords', value: 'no' }
        - { key: 'GSSAPIAuthentication', value: 'no' }
        - { key: 'ChallengeResponseAuthentication', value: 'no' }
        - { key: 'KerberosAuthentication', value: 'no' }
        - { key: 'PermitRootLogin', value: 'no' }
        - { key: 'X11Forwarding', value: 'no' }
        - { key: 'AllowTcpForwarding', value: 'yes' }
        - { key: 'ClientAliveCountMax', value: '3' }
        - { key: 'ClientAliveInterval', value: '300' }
        - { key: 'LoginGraceTime', value: '15' }
        - { key: 'Ciphers', value: 'aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr' }
        - { key: 'MACs', value: 'hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512' }
        - { key: 'KexAlgorithms', value: 'curve25519-sha256@libssh.org' }
        - { key: 'AllowUsers', value: '{{allow_ssh_users}}' }
      notify: [ Restart sshd ]
      tags: [ 'sshd' ]

    - name: Ensure firewalld is running
      service:
        name: firewalld
        state: started
        enabled: yes
      become: yes
      tags: [ 'firewall' ]

    - name: Create custom zone to use by default
      firewalld:
        zone: GoAway
        state: present
        permanent: true
      become: yes
      notify: [ Reload firewalld ]
      tags: [ 'firewall' ]

    - meta: flush_handlers

    - name: Allow basic services in firewall
      firewalld:
        service: '{{item}}'
        permanent: yes
        state: enabled
        immediate: yes
        zone: GoAway
      loop:
        - dhcpv6-client
        - mdns
        - samba-client
        - ssh
        - cockpit
      become: yes
      tags: [ 'firewall' ]

    - name: Set GoAway as default policy
      command: firewall-cmd --set-default-zone=GoAway
      become: yes
      tags: [ 'firewall' ]