feat: initial commit — Ansible roles storage-01/gpu-01 opérationnels

ansible/roles/common/tasks/main.yml

@@ -0,0 +1,71 @@
+---
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ inventory_hostname }}"
+
+- name: Set timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+
+- name: Enable EPEL repository
+  ansible.builtin.dnf:
+    name: epel-release
+    state: present
+
+- name: Upgrade all packages
+  ansible.builtin.dnf:
+    name: "*"
+    state: latest
+    update_cache: true
+  tags: update
+  notify: Reboot if kernel updated
+
+- name: Install base packages
+  ansible.builtin.dnf:
+    name: "{{ base_packages }}"
+    state: present
+
+- name: Enable and start chrony
+  ansible.builtin.systemd:
+    name: chronyd
+    enabled: true
+    state: started
+
+- name: Create ansible group
+  ansible.builtin.group:
+    name: "{{ ansible_service_user }}"
+    state: present
+
+- name: Create ansible user
+  ansible.builtin.user:
+    name: "{{ ansible_service_user }}"
+    group: "{{ ansible_service_user }}"
+    groups: wheel
+    shell: /bin/bash
+    create_home: true
+    state: present
+
+- name: Allow ansible user passwordless sudo
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/ansible
+    content: "{{ ansible_service_user }} ALL=(ALL) NOPASSWD:ALL\n"
+    mode: '0440'
+    validate: /usr/sbin/visudo -cf %s
+
+- name: Set up SSH authorized key for ansible user
+  ansible.posix.authorized_key:
+    user: "{{ ansible_service_user }}"
+    key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"
+    state: present
+
+- name: Harden sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+    state: present
+  loop:
+    - { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
+    - { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
+    - { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
+  notify: Restart sshd