Add user role

11 files changed, 164 insertions, 0 deletions

diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example
index e0529a63..359bf2ed 100644
--- a/group_vars/all.yml.example
+++ b/group_vars/all.yml.example
@@ -1,3 +1,7 @@
 ---
+username: "test_user"
+user_public_keys:
+  - "ssh-ed25519 AAAA...fMo"
+  - "ssh-rsa AAAA...4I3"
 network_wifi_ssid: "TEST_WIFI_SSID"
 network_wifi_pass: "TEST_WIFI_PASS"
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
index d0c2418d..1399e996 100644
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@@ -5,5 +5,8 @@
     ansible_become_method: su
     network_wifi_ssid: "TEST_WIFI_SSID"
     network_wifi_pass: "TEST_WIFI_PASS"
+    username: test_user
+    user_groups: ["wheel", "test_group"]
   roles:
     - role: network
+    - role: user
diff --git a/roles/user/README.md b/roles/user/README.md
new file mode 100644
index 00000000..ba795d1a
--- /dev/null
+++ b/roles/user/README.md
@@ -0,0 +1,27 @@
+# Ansible Role: User
+
+This role creates the user and configures the `sudo` group for the user
+
+## Role Variables
+
+- `username` **Required** name of the user to be created.
+- `user_password` created user default password (default: `changeme`).
+- `user_public_keys` the list of ssh public keys to be added to user authorized_keys
+- `user_groups` extra groups to be created and user added to them (default: [])
+
+## Internals
+
+- ensure `sudo` installed.
+- configure `sudoers` file to grant `%sudo ALL=(ALL:ALL) ALL` for `sudo` group.
+- create user and add to the `username`, `sudo`, extra `user_groups` groups.
+- require user password change on first use of `sudo` command.
+- configure the user authorized keys to allow public key authentication (if configured).
+
+### Caveats
+
+If no public key authentication is configured by this role,
+the user won't be able to login (since the hardened ssh role disable root and password authentication).
+
+For this reason, if you want to enable the insecure password authentication,
+please update the ssh role `"Configure authentication policy"` manually to
+allow for password/root authentication, These features are disabled by default.
diff --git a/roles/user/defaults/main.yml b/roles/user/defaults/main.yml
new file mode 100644
index 00000000..55fa2869
--- /dev/null
+++ b/roles/user/defaults/main.yml
@@ -0,0 +1,7 @@
+---
+# Default user password: changeme
+# Password will be required to change after first usage
+user_password:
+  '$6$jF4YTa1r2tKMH4b3$9KdWeEXJ0RfaS0EfTE6CPFmJFxPABXa455U0Wc47iGxqvsgchkcuRAha/hus//mG7mxWdfEFkLkCKeBsdyLcX/'
+
+user_groups: []
diff --git a/roles/user/handlers/main.yml b/roles/user/handlers/main.yml
new file mode 100644
index 00000000..2d9b6c32
--- /dev/null
+++ b/roles/user/handlers/main.yml
@@ -0,0 +1,7 @@
+---
+- name: "Require password change"
+  become: true
+  ansible.builtin.command:
+    cmd: chage -d 0 "{{ username }}"
+  changed_when: true
+  when: user.changed
diff --git a/roles/user/meta/argument_specs.yml b/roles/user/meta/argument_specs.yml
new file mode 100644
index 00000000..5f4b1fd4
--- /dev/null
+++ b/roles/user/meta/argument_specs.yml
@@ -0,0 +1,18 @@
+---
+argument_specs:
+  main:
+    options:
+      username:
+        type: "str"
+        required: true
+        description: "The username of the created account."
+      user_public_keys:
+        type: "list"
+        required: true
+        description: "The list SSH public key to be added to user authorized_keys."
+        elements: "str"
+      user_groups:
+        type: "list"
+        description: "The list of groups the user should be added to."
+        elements: "str"
+        default: []
diff --git a/roles/user/meta/main.yml b/roles/user/meta/main.yml
new file mode 100644
index 00000000..7130e132
--- /dev/null
+++ b/roles/user/meta/main.yml
@@ -0,0 +1,19 @@
+---
+dependencies: []
+galaxy_info:
+  role_name: user
+  author: a14m
+  description: "Configure user and sudo"
+  company: "kartoffeln.work GmbH."
+  license: "license MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: ArchLinux
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - noble
+    - name: Debian
+      versions:
+        - bookworm
diff --git a/roles/user/tasks/install-archlinux.yml b/roles/user/tasks/install-archlinux.yml
new file mode 100644
index 00000000..84a7f0c2
--- /dev/null
+++ b/roles/user/tasks/install-archlinux.yml
@@ -0,0 +1,7 @@
+---
+- name: "Ensure sudo installed"
+  become: true
+  community.general.pacman:
+    name: "sudo"
+    state: "present"
+  tags: [required_for_boot]
diff --git a/roles/user/tasks/install-debian.yml b/roles/user/tasks/install-debian.yml
new file mode 100644
index 00000000..6d59e934
--- /dev/null
+++ b/roles/user/tasks/install-debian.yml
@@ -0,0 +1,7 @@
+---
+- name: "Ensure sudo installed"
+  become: true
+  ansible.builtin.apt:
+    name: "sudo"
+    state: "present"
+  tags: [required_for_boot]
diff --git a/roles/user/tasks/main.yml b/roles/user/tasks/main.yml
new file mode 100644
index 00000000..4bc5fe4f
--- /dev/null
+++ b/roles/user/tasks/main.yml
@@ -0,0 +1,64 @@
+---
+- name: "Install OS-specific packages"
+  ansible.builtin.include_tasks: "install-{{ ansible_os_family | lower }}.yml"
+  tags: [required_for_boot]
+
+- name: "Set sudo group fact"
+  ansible.builtin.set_fact:
+    sudo_group: "sudo"
+  tags: [required_for_boot]
+
+- name: "Set user groups fact"
+  ansible.builtin.set_fact:
+    user_groups: "{{ ([username, sudo_group] + user_groups) | unique }}"
+
+- name: "Configure permissions for group: {{ sudo_group }}"
+  become: true
+  community.general.sudoers:
+    name: "enable-sudo-group"
+    group: "{{ sudo_group }}"
+    commands: "ALL"
+    nopassword: false
+    sudoers_path: "/etc/sudoers.d"
+    state: present
+  tags: [required_for_boot]
+
+- name: "Ensure user groups are created"
+  become: true
+  ansible.builtin.group:
+    name: "{{ item }}"
+    state: "present"
+  with_items: "{{ user_groups }}"
+  tags: [required_for_boot]
+
+- name: "Create user: {{ username }}"
+  become: true
+  ansible.builtin.user:
+    name: "{{ username }}"
+    append: false
+    create_home: true
+    generate_ssh_key: false
+    groups: "{{  user_groups }}"
+    password: "{{ user_password }}"
+    state: "present"
+    update_password: "on_create"
+  register: user
+  notify: "Require password change"
+  tags: [required_for_boot]
+
+- name: "Create user ssh directory"
+  ansible.builtin.file:
+    path: "/home/{{ username }}/.ssh/"
+    mode: "0700"
+    owner: "{{ username }}"
+    state: "directory"
+  tags: [required_for_boot]
+
+- name: "Add user ssh authorized_keys"
+  ansible.builtin.copy:
+    dest: "/home/{{ username }}/.ssh/authorized_keys"
+    mode: "0600"
+    owner: "{{ username }}"
+    content: |
+      {{ user_public_keys | join('\n') }}
+  tags: [required_for_boot]
diff --git a/site.yml b/site.yml
index 35e125d2..73da90c3 100644
--- a/site.yml
+++ b/site.yml
@@ -6,3 +6,4 @@
     - chroot
   roles:
     - role: "network"
+    - role: "user"