import sudo role from infra-metal

4 files changed, 37 insertions, 0 deletions

diff --git a/roles/sudo/README.md b/roles/sudo/README.md
new file mode 100644
index 0000000..bc452aa
--- /dev/null
+++ b/roles/sudo/README.md
@@ -0,0 +1,3 @@
+* Install sudo, if unavailable.
+* Configure sudo_user to run everything without password and, optionally,
+  preserve some environment variables.
diff --git a/roles/sudo/defaults/main.yml b/roles/sudo/defaults/main.yml
new file mode 100644
index 0000000..d17f56a
--- /dev/null
+++ b/roles/sudo/defaults/main.yml
@@ -0,0 +1,4 @@
+sudo_user: '{{ ansible_user }}'
+
+# Environment variables to preserve for sudo calls:
+sudo_env: []
diff --git a/roles/sudo/tasks/main.yml b/roles/sudo/tasks/main.yml
new file mode 100644
index 0000000..7bdd157
--- /dev/null
+++ b/roles/sudo/tasks/main.yml
@@ -0,0 +1,24 @@
+- name: Install sudo
+  become: true
+  ansible.builtin.package:
+    name: sudo
+    state: present
+
+- name: Create /etc/sudoers.d
+  become: true
+  ansible.builtin.file:
+    path: /etc/sudoers.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0750'
+
+- name: Configure sudoer
+  become: true
+  ansible.builtin.template:
+    src: sudoers.j2
+    dest: '/etc/sudoers.d/{{ sudo_user }}'
+    owner: root
+    group: root
+    mode: '440'
+    validate: 'visudo -cf %s'
diff --git a/roles/sudo/templates/sudoers.j2 b/roles/sudo/templates/sudoers.j2
new file mode 100644
index 0000000..6353ce6
--- /dev/null
+++ b/roles/sudo/templates/sudoers.j2
@@ -0,0 +1,6 @@
+{{ ansible_managed | comment }}
+
+# Preserve my environment variables:
+Defaults env_keep += "{{ sudo_env | join(' ') }}"
+# Don't prompt for password for {{ sudo_user }}:
+{{ sudo_user }} ALL=(ALL) NOPASSWD:ALL