diff options
| author | Egor Tensin <egor@tensin.name> | 2026-10-23 10:53:27 +0300 |
|---|---|---|
| committer | Egor Tensin <egor@tensin.name> | 2026-10-23 10:55:52 +0300 |
| commit | 782d1eeb694e2574c9380422abc446a6c3fc9c76 (patch) | |
| tree | 02e4a794fca1b73c09ea40a80d8a370ffbb43b30 | |
| parent | pacman_install: fix a typo (diff) | |
| download | infra-ansible-782d1eeb694e2574c9380422abc446a6c3fc9c76.tar.gz infra-ansible-782d1eeb694e2574c9380422abc446a6c3fc9c76.zip | |
import sudo role from infra-metal
| -rw-r--r-- | roles/sudo/README.md | 3 | ||||
| -rw-r--r-- | roles/sudo/defaults/main.yml | 4 | ||||
| -rw-r--r-- | roles/sudo/tasks/main.yml | 24 | ||||
| -rw-r--r-- | roles/sudo/templates/sudoers.j2 | 6 |
4 files changed, 37 insertions, 0 deletions
diff --git a/roles/sudo/README.md b/roles/sudo/README.md new file mode 100644 index 0000000..bc452aa --- /dev/null +++ b/roles/sudo/README.md @@ -0,0 +1,3 @@ +* Install sudo, if unavailable. +* Configure sudo_user to run everything without password and, optionally, + preserve some environment variables. diff --git a/roles/sudo/defaults/main.yml b/roles/sudo/defaults/main.yml new file mode 100644 index 0000000..d17f56a --- /dev/null +++ b/roles/sudo/defaults/main.yml @@ -0,0 +1,4 @@ +sudo_user: '{{ ansible_user }}' + +# Environment variables to preserve for sudo calls: +sudo_env: [] diff --git a/roles/sudo/tasks/main.yml b/roles/sudo/tasks/main.yml new file mode 100644 index 0000000..7bdd157 --- /dev/null +++ b/roles/sudo/tasks/main.yml @@ -0,0 +1,24 @@ +- name: Install sudo + become: true + ansible.builtin.package: + name: sudo + state: present + +- name: Create /etc/sudoers.d + become: true + ansible.builtin.file: + path: /etc/sudoers.d + state: directory + owner: root + group: root + mode: '0750' + +- name: Configure sudoer + become: true + ansible.builtin.template: + src: sudoers.j2 + dest: '/etc/sudoers.d/{{ sudo_user }}' + owner: root + group: root + mode: '440' + validate: 'visudo -cf %s' diff --git a/roles/sudo/templates/sudoers.j2 b/roles/sudo/templates/sudoers.j2 new file mode 100644 index 0000000..6353ce6 --- /dev/null +++ b/roles/sudo/templates/sudoers.j2 @@ -0,0 +1,6 @@ +{{ ansible_managed | comment }} + +# Preserve my environment variables: +Defaults env_keep += "{{ sudo_env | join(' ') }}" +# Don't prompt for password for {{ sudo_user }}: +{{ sudo_user }} ALL=(ALL) NOPASSWD:ALL |