Finalize and debug bootstrap playbook

skylab/infra/playbooks/bootstrap.yml

@@ -13,7 +13,7 @@
   - name: bootstrap_password
     prompt: Enter password to use for connecting to boostrap target
     private: true
-    confirm: true
+    default: skylab
   - name: bootstrap_port
     prompt: Enter SSH port to connect to on bootstrap target
     default: 22
@@ -32,6 +32,11 @@
   hosts: bootstrap
   vars:
     ansible_host_key_checking: false
+  vars_prompt:
+  - name: vault_password
+    prompt: Enter Ansible vault password for generating user secrets
+    private: true
+    confirm: true
   tasks:
   - name: Fetch install path
     ansible.builtin.stat:
@@ -58,17 +63,17 @@
       fail_msg: >-
         Host has already been boostrapped
 
-  - name: Update ansible user account
-    ansible.builtin.user:
-      name: ansible
-      state: present
-      uid: 1400
-      password: # WIP
-
-  - name: Remove ansible user group
-    ansible.builtin.group:
-      name: ansible
-      state: absent
+  - name: Check that management keys are defined
+    ansible.builtin.assert:
+      that:
+        - skylab_mgmt_keys is defined
+        - skylab_mgmt_keys != []
+      success_msg: >-
+        Found {{ skylab_mgmt_keys | length }} SSH keys to install to the Ansible management user
+      fail_msg: >-
+        No management keys were found for installation to the Ansible management user. Aborting to avoid
+        locking out SSH access to the boostrap host. Please define the 'skylab_mgmt_keys' variable with
+        a list of SSH public keys to install to the Ansible management user.
 
   - name: Create skylab group
     ansible.builtin.group:
@@ -77,28 +82,53 @@
       gid: 1400
 
   - name: Update ansible user authorized keys
-    ansible.posix.authorized_keys:
+    ansible.posix.authorized_key:
       user: ansible
       exclusive: true
-      key: []
+      key: "{{ skylab_mgmt_keys | join('\n') }}"
 
-  - name: Update root user account
+  - name: Generate ansible user account password
+    delegate_to: localhost
+    no_log: true
+    changed_when: false
+    ansible.builtin.shell:
+      cmd: >
+        command mpw -qq -F none -t max -u ansible {{ ansible_host }} -p <<<
+        '{{ vault_password }}' |
+        python3 -c 'import crypt; print(crypt.crypt(input(), crypt.mksalt(crypt.METHOD_SHA512)))'
+      executable: /bin/bash
+    register: _password_ansible
+
+  - name: Update ansible user account
     ansible.builtin.user:
       name: ansible
       state: present
-      password: # WIP
+      group: skylab
+      groups:
+        - skylab
+        - wheel
+      uid: 1400
+      password: "{{ _password_ansible.stdout }}"
+
+  - name: Remove ansible user group
+    ansible.builtin.group:
+      name: ansible
+      state: absent
 
   - name: Update root user authorized keys
-    ansible.posix.authorized_keys:
+    ansible.posix.authorized_key:
       user: root
       exclusive: true
-      key: []
+      key: ""
 
-  - name: Update SSHD port
-    ansible.builtin.replace:
-      path: /etc/ssh/sshd_config
-      regexp: "^(#?)Port [0-9]+$"
-      replace: "Port 4242"
+  - name: Disable sudo password for WHEEL group
+    become: true
+    ansible.builtin.copy:
+      content: "%wheel ALL=(ALL) NOPASSWD: ALL"
+      dest: /etc/sudoers.d/30-wheel
+      owner: root
+      group: skylab
+      mode: 0644
 
   - name: Disable SSHD password auth
     ansible.builtin.replace:
@@ -117,7 +147,24 @@
       name: "*"
       state: latest
       allowerasing: true
-      autoremove: true
+
+  - name: Generate root user account password
+    delegate_to: localhost
+    no_log: true
+    changed_when: false
+    ansible.builtin.shell:
+      cmd: >
+        command mpw -qq -F none -t max -u ansible {{ ansible_host }} -p <<<
+        '{{ vault_password }}' |
+        python3 -c 'import crypt; print(crypt.crypt(input(), crypt.mksalt(crypt.METHOD_SHA512)))'
+      executable: /bin/bash
+    register: _password_root
+
+  - name: Update root user account
+    ansible.builtin.user:
+      name: root
+      state: present
+      password: "{{ _password_root.stdout }}"
 
   - name: Create SkyLab directory
     ansible.builtin.file: