feat: add users role

Author: bruzina

README.md

@@ -6,11 +6,12 @@ This Ansible collection provides a set of roles designed for configuring Kubuntu
 
 ### Roles
 
-| Role                                           | Description                                                                                                                                | Dependencies           |
-| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------- |
-| [xebis.ansible.apt](roles/apt/README.md)       | Deb package updates and upgrades using the apt package manager. Can optionally clean up unused packages and reboot the system if required. | `xebis.ansible.system` |
-| `xebis.ansible.openssh_server`                 | Installs OpenSSH server installation and provides `Restart ssh` handler.                                                                   | `xebis.ansible.apt`    |
-| [xebis.ansible.system](roles/system/README.md) | System-related tasks such as reboot handler or reboot when required handler.                                                               |                        |
+| Role                                           | Description                                                                                                                                | Dependencies                   |
+| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
+| [xebis.ansible.apt](roles/apt/README.md)       | Deb package updates and upgrades using the apt package manager. Can optionally clean up unused packages and reboot the system if required. | `xebis.ansible.system`         |
+| `xebis.ansible.openssh_server`                 | Installs OpenSSH server installation and provides `Restart ssh` handler.                                                                   | `xebis.ansible.apt`            |
+| [xebis.ansible.system](roles/system/README.md) | System-related tasks such as reboot handler or reboot when required handler.                                                               |                                |
+| [`xebis.ansible.users`](roles/users/README.md) | Ansible role for managing system users.                                                                                                    | `xebis.ansible.openssh_server` |
 
 ## Contributing
 

roles/users/README.md

@@ -0,0 +1,55 @@
+# Xebis.Ansible.Users
+
+Ansible role for managing system users.
+
+## Tasks
+
+- Create users and user groups
+- Grant admin (sudo) access
+- Manage SSH keys
+- Fine tune SSH authentication settings
+
+```yaml
+---
+- hosts: all
+  roles:
+    - role: xebis.ansible.users
+      vars:
+        passwordless_sudo: true
+        ssh_password_login: false
+        users:
+          - user: example
+            admin: true
+            ssh_keys_urls:
+              - https://github.com/example.keys
+```
+
+## Variables
+
+- `ssh_password_login` [boolean]
+  - Enables or disables password-based SSH authentication.
+  - Default `true`
+- `passwordless_sudo` [boolean]
+  - Grants sudo privileges without a password when set to true.
+  - Default `false`
+- `users` [list]
+  - List of users to be created. See structure below.
+  - Default `[]`.
+  - The structure:
+    - `user` [string]
+      - Username.
+      - Required parameter.
+    - `admin` [boolean]
+      - Adds user to the `sudo` group.
+      - Default `false`
+    - `ssh_keys` [list]
+      - List of SSH public keys for the user.
+      - Default `[]`
+    - `ssh_keys_urls` [list]
+      - URLs pointing to SSH public keys (e.g., GitHub keys).
+      - Default `[]`
+
+## Handlers
+
+- `Disable password SSH login`
+  - When `ssh_password_login` is set to `false` disables password SSH login, only SSH keys are allowed.

roles/users/handlers/main.yaml

@@ -0,0 +1,10 @@
+---
+- name: Disable password SSH login
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/ssh/sshd_config
+    regexp: ^(#\s*)?PasswordAuthentication
+    line: PasswordAuthentication no
+  when: ssh_password_login | default(true)
+  listen: Disable password SSH login
+  notify: Restart ssh

roles/users/meta/main.yaml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: xebis.ansible.openssh_server # Uses "Restart ssh" handler

roles/users/tasks/main.yaml

@@ -0,0 +1,61 @@
+---
+- name: Add user groups
+  become: true
+  ansible.builtin.group:
+    name: "{{ item.user }}"
+    state: present
+  loop: "{{ users }}"
+
+- name: Add sudo group as passwordless sudoer
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/sudoers.d/xebis-ansible-users
+    create: true
+    regexp: ^%sudo
+    line: "%sudo ALL=(ALL) NOPASSWD: ALL"
+    state: present
+    validate: visudo -cf %s
+  when: passwordless_sudo | default(false)
+
+- name: Add admins
+  become: true
+  ansible.builtin.user:
+    name: "{{ item.user }}"
+    group: "{{ item.user }}"
+    groups:
+      - sudo
+      - users
+    shell: /bin/bash
+    state: present
+  loop: "{{ users }}"
+  when: item.admin
+
+- name: Add users
+  become: true
+  ansible.builtin.user:
+    name: "{{ item.user }}"
+    group: "{{ item.user }}"
+    groups:
+      - users
+    shell: /bin/bash
+    state: present
+  loop: "{{ users }}"
+  when: not item.admin
+
+- name: Add SSH authorized key lists
+  become: true
+  ansible.posix.authorized_key:
+    user: "{{ item.0.user }}"
+    key: "{{ lookup('url', item.1, split_lines=False) }}"
+    state: present
+  loop: "{{ users | subelements('ssh_keys_urls', skip_missing=true) }}"
+  notify: Disable password SSH login
+
+- name: Add SSH authorized keys
+  become: true
+  ansible.posix.authorized_key:
+    user: "{{ item.0.user }}"
+    key: "{{ item.1 }}"
+    state: present
+  loop: "{{ users | subelements('ssh_keys', skip_missing=true) }}"
+  notify: Disable password SSH login

test.yaml

@@ -9,3 +9,12 @@
         purge: true
         upgrade: "full"
     - role: xebis.ansible.openssh_server
+    - role: xebis.ansible.users
+      vars:
+        passwordless_sudo: true
+        ssh_password_login: false
+        users:
+          - user: mb
+            admin: true
+            ssh_keys_urls:
+              - https://github.com/bruzina.keys