initial opencode commit

roles/auth/tasks/main.yml

@@ -0,0 +1,70 @@
+---
+# Create the administrative user, install its SSH key, enforce password
+# policy, and lock the root account.
+
+- name: Create the administrative user
+  ansible.builtin.user:
+    name: "{{ admin_user }}"
+    groups: wheel
+    append: true
+    create_home: true
+    home: "/home/{{ admin_user }}"
+    shell: /bin/bash
+    comment: "Minecraft server administrator"
+    password: "{{ admin_user_password_hash | default('!') }}"
+    password_expire_max: "{{ auth_password_max_days }}"
+    password_expire_min: "{{ auth_password_min_days }}"
+    state: present
+
+- name: Install the admin user's SSH public key
+  ansible.builtin.authorized_key:
+    user: "{{ admin_user }}"
+    state: present
+    key: "{{ admin_user_ssh_key }}"
+  when: admin_user_ssh_key | length > 0
+
+- name: Allow the admin user passwordless sudo
+  ansible.builtin.copy:
+    content: "{{ admin_user }} ALL=(ALL) NOPASSWD: ALL\n"
+    dest: "/etc/sudoers.d/{{ admin_user }}"
+    owner: root
+    group: root
+    mode: "0440"
+    validate: /usr/sbin/visudo -cf %s
+
+- name: Enforce password complexity settings
+  ansible.builtin.lineinfile:
+    path: /etc/security/pwquality.conf
+    regexp: '^#?\s*{{ item.key }}\s*='
+    line: "{{ item.key }} = {{ item.value }}"
+  loop:
+    - { key: minlen, value: "{{ auth_minlen }}" }
+    - { key: dcredit, value: "{{ auth_dcredit }}" }
+    - { key: ucredit, value: "{{ auth_ucredit }}" }
+    - { key: lcredit, value: "{{ auth_lcredit }}" }
+    - { key: ocredit, value: "{{ auth_ocredit }}" }
+
+- name: Enforce global password aging defaults
+  ansible.builtin.lineinfile:
+    path: /etc/login.defs
+    regexp: '^PASS_MAX_DAYS\s+'
+    line: "PASS_MAX_DAYS {{ auth_password_max_days }}"
+
+- name: Enforce minimum days between password changes
+  ansible.builtin.lineinfile:
+    path: /etc/login.defs
+    regexp: '^PASS_MIN_DAYS\s+'
+    line: "PASS_MIN_DAYS {{ auth_password_min_days }}"
+
+- name: Enforce password change warning
+  ansible.builtin.lineinfile:
+    path: /etc/login.defs
+    regexp: '^PASS_WARN_AGE\s+'
+    line: "PASS_WARN_AGE {{ auth_password_warn_age }}"
+
+- name: Lock the root account's password
+  ansible.builtin.user:
+    name: root
+    password: '!'
+    state: present
+  when: auth_lock_root_password | bool