Skip to content

Commit bc99d78

Browse files
NormoNormo
committed
Add hifis.ssh_keys role
Signed-off-by: Norman Ziegner <[email protected]>
1 parent 7144e0c commit bc99d78

File tree

15 files changed

+482
-5
lines changed

15 files changed

+482
-5
lines changed

‎.github/labeler.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@
44
# SPDX-License-Identifier: Apache-2.0
55

66
---
7+
ssh_keys:
8+
- changed-files:
9+
- any-glob-to-any-file:
10+
- "roles/ssh_keys/**"
11+
- "molecule/ssh_keys/**"
12+
- ".github/workflows/ssh_keys.yml"
713
unattended_upgrades:
814
- changed-files:
915
- any-glob-to-any-file:

‎.github/workflows/ssh_keys.yml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# SPDX-FileCopyrightText: Helmholtz Centre for Environmental Research (UFZ)
2+
# SPDX-FileCopyrightText: Helmholtz-Zentrum Dresden-Rossendorf (HZDR)
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
---
7+
name: "hifis.ssh_keys"
8+
9+
on:
10+
pull_request:
11+
paths:
12+
- '.github/workflows/ssh_keys.yml'
13+
- 'roles/ssh_keys/**'
14+
- 'molecule/ssh_keys/**'
15+
- 'Pipfile'
16+
- 'Pipfile.lock'
17+
push:
18+
branches:
19+
- "main"
20+
tags:
21+
- "v*.*.*"
22+
paths:
23+
- '.github/workflows/ssh_keys.yml'
24+
- 'roles/ssh_keys/**'
25+
- 'molecule/ssh_keys/**'
26+
- 'Pipfile'
27+
- 'Pipfile.lock'
28+
schedule:
29+
- cron: '0 0 * * *'
30+
31+
jobs:
32+
33+
test:
34+
name: "Run Molecule tests."
35+
runs-on: "ubuntu-22.04"
36+
env:
37+
PY_COLORS: 1
38+
ANSIBLE_FORCE_COLOR: 1
39+
strategy:
40+
fail-fast: false
41+
matrix:
42+
image:
43+
- "ghcr.io/hifis-net/centos-systemd:7"
44+
- "ghcr.io/hifis-net/almalinux-systemd:8"
45+
- "ghcr.io/hifis-net/almalinux-systemd:9"
46+
- "ghcr.io/hifis-net/ubuntu-systemd:18.04"
47+
- "ghcr.io/hifis-net/ubuntu-systemd:20.04"
48+
- "ghcr.io/hifis-net/ubuntu-systemd:22.04"
49+
- "ghcr.io/hifis-net/debian-systemd:10"
50+
- "ghcr.io/hifis-net/debian-systemd:11"
51+
52+
steps:
53+
- name: "Check out the codebase."
54+
uses: "actions/checkout@v4"
55+
with:
56+
path: "ansible_collections/hifis/toolkit"
57+
58+
- name: "Prepare the job environment."
59+
uses: "./ansible_collections/hifis/toolkit/.github/workflows/prepare-action"
60+
61+
# https://github.com/ansible/molecule/issues/3806
62+
- name: "Help molecule to find the dependencies"
63+
run: |
64+
mkdir -p /home/runner/.ansible
65+
ln -s /home/runner/work/ansible-collection-toolkit/ansible-collection-toolkit/ansible_collections/hifis/toolkit/roles \
66+
/home/runner/.ansible/roles
67+
68+
- name: "Install modern podman"
69+
run: |
70+
sudo mkdir -p /etc/apt/keyrings
71+
curl -fsSL https://download.opensuse.org/repositories/devel:kubic:libcontainers:unstable/xUbuntu_$(lsb_release -rs)/Release.key \
72+
| gpg --dearmor \
73+
| sudo tee /etc/apt/keyrings/devel_kubic_libcontainers_unstable.gpg > /dev/null
74+
echo \
75+
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/devel_kubic_libcontainers_unstable.gpg]\
76+
https://download.opensuse.org/repositories/devel:kubic:libcontainers:unstable/xUbuntu_$(lsb_release -rs)/ /" \
77+
| sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:unstable.list > /dev/null
78+
sudo apt-get update -qq
79+
sudo apt-get -qq -y install podman
80+
81+
- name: "Run Molecule tests."
82+
run: "pipenv run molecule test -s ssh_keys"
83+
env:
84+
MOLECULE_IMAGE: "${{ matrix.image }}"
85+
working-directory: "ansible_collections/hifis/toolkit"

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ SPDX-License-Identifier: Apache-2.0
1010
[![Latest release](https://img.shields.io/github/v/release/hifis-net/ansible-collection-toolkit)](https://github.com/hifis-net/ansible-collection-toolkit/releases)
1111
[![hifis.unattended_upgrades](https://github.com/hifis-net/ansible-collection-toolkit/actions/workflows/unattended_upgrades.yml/badge.svg)](https://github.com/hifis-net/ansible-collection-toolkit/actions/workflows/unattended_upgrades.yml)
1212
[![hifis.zammad](https://github.com/hifis-net/ansible-collection-toolkit/actions/workflows/zammad.yml/badge.svg)](https://github.com/hifis-net/ansible-collection-toolkit/actions/workflows/zammad.yml)
13+
[![DOI](https://zenodo.org/badge/495697576.svg)](https://zenodo.org/doi/10.5281/zenodo.11147483)
1314

1415
## Description
1516

@@ -28,7 +29,7 @@ software engineers, but not exclusively. The following use cases are supported:
2829
* OS-related:
2930
* [**unattended-upgrades**](roles/unattended_upgrades)
3031
* [netplan](https://github.com/hifis-net/ansible-role-gitlab-netplan) (coming soon!)
31-
* managing and distributing authorized [SSH keys](https://github.com/hifis-net/ansible-role-ssh-keys) (coming soon!)
32+
* distribute authorized [**SSH keys**](role/ssh_keys) to users
3233

3334
## Minimum required Ansible-version
3435

‎UNATTENDED_UPGRADES_CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
<!--
2+
SPDX-FileCopyrightText: Helmholtz Centre for Environmental Research (UFZ)
3+
SPDX-FileCopyrightText: Helmholtz-Zentrum Dresden-Rossendorf (HZDR)
4+
5+
SPDX-License-Identifier: Apache-2.0
6+
-->
7+
18
# Changelog
29

310
## [v3.3.0](https://github.com/hifis-net/ansible-collection-toolkit/tree/v3.3.0) (2024-03-01)

‎UNATTENDED_UPGRADES_CHANGELOG.md.license

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎molecule/ssh_keys/converge.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# SPDX-FileCopyrightText: Helmholtz Centre for Environmental Research (UFZ)
2+
# SPDX-FileCopyrightText: Helmholtz-Zentrum Dresden-Rossendorf (HZDR)
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
---
7+
- name: "Converge"
8+
hosts: "all"
9+
vars:
10+
ssh_user_list:
11+
- name: "dummyuser"
12+
authorized_keys:
13+
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJi3wBlOT+oR8Rd+YQsV8tUoQOd3NSUuyzJYQp8finD6 [email protected]"
14+
create_user_account: true
15+
- name: "root"
16+
authorized_keys:
17+
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJi3wBlOT+oR8Rd+YQsV8tUoQOd3NSUuyzJYQp8finD6 [email protected]"
18+
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDXkvy8jMmw45grnmYK+Ylk/mcc7IyG9taNseNiVrGjR8KRHVJpzEntW1g6SAomIGIpBLvviiyhal4E1v1bhpv2JopbiM3JDOck6gwc4AfpanjuZFPuq6stq5pF7bb2C+zliw16zTFL7bp09tD7nNs30GlchB5DU2sSn1zq4iC+eQ== [email protected]" # noqa 204
19+
tasks:
20+
- name: "Include ssh_keys role"
21+
ansible.builtin.include_role:
22+
name: "hifis.toolkit.ssh_keys"

‎molecule/ssh_keys/molecule.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# SPDX-FileCopyrightText: Helmholtz Centre for Environmental Research (UFZ)
2+
# SPDX-FileCopyrightText: Helmholtz-Zentrum Dresden-Rossendorf (HZDR)
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
---
7+
dependency:
8+
name: "galaxy"
9+
options:
10+
requirements-file: "molecule/ssh_keys/requirements.yml"
11+
driver:
12+
name: "podman"
13+
platforms:
14+
- name: "instance"
15+
image: "${MOLECULE_IMAGE:-ghcr.io/hifis-net/ubuntu-systemd:22.04}"
16+
pre_build_image: true
17+
privileged: true
18+
override_command: false
19+
systemd: true
20+
tty: true
21+
provisioner:
22+
name: "ansible"
23+
verifier:
24+
name: "ansible"

‎molecule/ssh_keys/requirements.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# SPDX-FileCopyrightText: Helmholtz Centre for Environmental Research (UFZ)
2+
# SPDX-FileCopyrightText: Helmholtz-Zentrum Dresden-Rossendorf (HZDR)
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
---
7+
8+
collections:
9+
- name: "ansible.posix"

‎molecule/ssh_keys/verify.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# SPDX-FileCopyrightText: Helmholtz Centre for Environmental Research (UFZ)
2+
# SPDX-FileCopyrightText: Helmholtz-Zentrum Dresden-Rossendorf (HZDR)
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
---
7+
- name: "Verify"
8+
hosts: "all"
9+
tasks:
10+
- name: "Ensure ssh dummy user is present"
11+
ansible.builtin.user:
12+
name: "dummyuser"
13+
state: "present"
14+
register: "dummyuser"
15+
failed_when: "dummyuser.changed"
16+
17+
- name: "Ensure ssh key for newly created user is present"
18+
ansible.builtin.lineinfile:
19+
path: "/home/dummyuser/.ssh/authorized_keys"
20+
regexp: '^{{ ssh_public_key }}(.*)$'
21+
line: '{{ ssh_public_key }}\1'
22+
state: "present"
23+
backrefs: true
24+
check_mode: true
25+
register: "line_in_file"
26+
failed_when: "(line_in_file.changed) or (line_in_file.failed)"
27+
vars:
28+
ssh_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJi3wBlOT+oR8Rd+YQsV8tUoQOd3NSUuyzJYQp8finD6 [email protected]"
29+
30+
- name: "Ensure ssh key for existing user is present"
31+
ansible.builtin.lineinfile:
32+
path: "/root/.ssh/authorized_keys"
33+
regexp: '^{{ item }}(.*)$'
34+
line: '{{ item }}\1'
35+
state: "present"
36+
backrefs: true
37+
check_mode: true
38+
register: "line_in_file"
39+
failed_when: "(line_in_file.changed) or (line_in_file.failed)"
40+
loop:
41+
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJi3wBlOT+oR8Rd+YQsV8tUoQOd3NSUuyzJYQp8finD6 [email protected]"
42+
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDXkvy8jMmw45grnmYK+Ylk/mcc7IyG9taNseNiVrGjR8KRHVJpzEntW1g6SAomIGIpBLvviiyhal4E1v1bhpv2JopbiM3JDOck6gwc4AfpanjuZFPuq6stq5pF7bb2C+zliw16zTFL7bp09tD7nNs30GlchB5DU2sSn1zq4iC+eQ== [email protected]" # noqa 204

‎requirements.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@
66
---
77

88
collections:
9+
- name: "ansible.posix"
910
- name: "community.crypto"

0 commit comments

Comments
 (0)