Refactor: move password policy to its own role

13 files changed, 78 insertions, 94 deletions

diff --git a/roles/password_policy/README.md b/roles/password_policy/README.md
new file mode 100644
index 00000000..c499dcdc
--- /dev/null
+++ b/roles/password_policy/README.md
@@ -0,0 +1,21 @@
+# Ansible Role: password_policy
+
+This role configure the machine password quality policy
+
+## Role Variables
+
+- `password_policy_enabled` boolean to enable or disable the enforcement of password policy
+- `password_policy_difok` the number of differences between new and old password (default 0 - disabled)
+- `password_policy_minlen` min password length (default 8)
+- `password_policy_dcredit` required digits in password (default 0)
+- `password_policy_ucredit` required uppercase chars in password (default 0)
+- `password_policy_ocredit` required other chars in password (default 0)
+- `password_policy_lcredit` required lowercase chars in password (default 0)
+- `password_policy_minclass` required minimum classes in password upper/lower/digit/other (default 0 - disabled)
+- `password_policy_maxrepeat` allowed maximum repeats in password (default 0 - disabled)
+- `password_policy_maxclassrepeat` maximum allowed consecutive class repeats (default 0 -disabled)
+- `password_policy_gecoscheck` (default 0 - disabled)
+
+## Docs
+
+- https://linux.die.net/man/8/pam_pwquality
diff --git a/roles/password_policy/defaults/main.yml b/roles/password_policy/defaults/main.yml
new file mode 100644
index 00000000..1c5f7254
--- /dev/null
+++ b/roles/password_policy/defaults/main.yml
@@ -0,0 +1,14 @@
+---
+# Password policy
+# https://linux.die.net/man/8/pam_pwquality
+password_policy_enabled: true
+password_policy_difok: 0
+password_policy_minlen: 8
+password_policy_dcredit: 0
+password_policy_ucredit: 0
+password_policy_ocredit: 0
+password_policy_lcredit: 0
+password_policy_minclass: 0
+password_policy_maxrepeat: 0
+password_policy_maxclassrepeat: 0
+password_policy_gecoscheck: 0
diff --git a/roles/settings/meta/argument_specs.yml b/roles/password_policy/meta/argument_specs.yml
index 0507db86..8c312a8c 100644
--- a/roles/settings/meta/argument_specs.yml
+++ b/roles/password_policy/meta/argument_specs.yml
@@ -2,51 +2,47 @@
 argument_specs:
   main:
     options:
-      settings_timezone:
-        type: "str"
-        description: "timezone configuration to use"
-        default: "UTC"
-      settings_pw_policy_enabled:
+      password_policy_enabled:
         type: "bool"
         description: "Enable password policy"
         default: true
-      settings_pw_policy_difok:
+      password_policy_difok:
         type: "int"
         description: "The number of differences between new and old password"
         default: 0
-      settings_pw_policy_minlen:
+      password_policy_minlen:
         type: "int"
         description: "Min password length"
         default: 8
-      settings_pw_policy_dcredit:
+      password_policy_dcredit:
         type: "int"
         description: "Num of digits required in password"
         default: 0
-      settings_pw_policy_ucredit:
+      password_policy_ucredit:
         type: "int"
         description: "Num of uppercase chars required in password"
         default: 0
-      settings_pw_policy_ocredit:
+      password_policy_ocredit:
         type: "int"
         description: "Num of special chars required in password"
         default: 0
-      settings_pw_policy_lcredit:
+      password_policy_lcredit:
         type: "int"
         description: "Num of lowercase chars required in password"
         default: 0
-      settings_pw_policy_minclass:
+      password_policy_minclass:
         type: "int"
         description: "Num of required classes (upper/lower/digit/special) chars required in password"
         default: 0
-      settings_pw_policy_maxrepeat:
+      password_policy_maxrepeat:
         type: "int"
         description: "Num of allowed repeats in password"
         default: 0
-      settings_pw_policy_maxclassrepeat:
+      password_policy_maxclassrepeat:
         type: "int"
         description: "Maximum number of consecutive class repeats in password"
         default: 0
-      settings_pw_policy_gecoscheck:
+      password_policy_gecoscheck:
         type: "int"
         description: |
           If nonzero, check whether the individual words longer than 3 characters from the
diff --git a/roles/settings/meta/main.yml b/roles/password_policy/meta/main.yml
index d8070386..fdcf75a1 100644
--- a/roles/settings/meta/main.yml
+++ b/roles/password_policy/meta/main.yml
@@ -1,9 +1,9 @@
 ---
 dependencies: []
 galaxy_info:
-  role_name: settings
+  role_name: password_policy
   author: a14m
-  description: "Configure the linux distro settings"
+  description: "Configure the linux distro password policy"
   company: "kartoffeln.work GmbH."
   license: "license MIT"
   min_ansible_version: "2.18"
diff --git a/roles/settings/tasks/main.yml b/roles/password_policy/tasks/main.yml
index 32fe9178..10aa3837 100644
--- a/roles/settings/tasks/main.yml
+++ b/roles/password_policy/tasks/main.yml
@@ -2,13 +2,11 @@
 - name: "Include OS-specific variables"
   ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
 
-- name: "Ensure settings packages are installed"
+- name: "Ensure password_policy package is installed"
   become: true
   ansible.builtin.package:
-    name: "{{ item }}"
+    name: "{{ password_policy_pkg }}"
     state: "present"
-  with_items:
-    - "{{ settings_pw_quality }}"
 
 - name: "Configure archlinux password policy"
   become: true
@@ -17,10 +15,6 @@
     dest: "/etc/pam.d/system-auth"
     mode: "0644"
   when: ansible_os_family == "Archlinux"
-  # Password policy is technically not required for boot,
-  # But it's quite nice to configure it for boot and therefore
-  # enforce the required policies/configurations wanted for the first passwrod change
-  tags: ["required_for_boot"]
 
 - name: "Configure debian password policy"
   become: true
@@ -29,7 +23,3 @@
     dest: "/etc/pam.d/common-password"
     mode: "0644"
   when: ansible_os_family == "Debian"
-  # Password policy is technically not required for boot,
-  # But it's quite nice to configure it for boot and therefore
-  # enforce the required policies/configurations wanted for the first passwrod change
-  tags: ["required_for_boot"]
diff --git a/roles/settings/templates/archlinux-pam-pw.j2 b/roles/password_policy/templates/archlinux-pam-pw.j2
index 7be41ccb..b5e3914e 100644
--- a/roles/settings/templates/archlinux-pam-pw.j2
+++ b/roles/password_policy/templates/archlinux-pam-pw.j2
@@ -17,26 +17,26 @@ account    required                    pam_unix.so
 account    optional                    pam_permit.so
 account    required                    pam_time.so
 
-{% if settings_pw_policy_enabled %}
+{% if password_policy_enabled %}
 -password  [success=2 default=ignore]  pam_systemd_home.so
 password   requisite                   pam_pwquality.so     retry=3 \
-                                                            difok={{ settings_pw_policy_difok }} \
-                                                            minlen={{ settings_pw_policy_minlen }} \
-                                                            dcredit={{ settings_pw_policy_dcredit }} \
-                                                            ucredit={{ settings_pw_policy_ucredit }} \
-                                                            ocredit={{ settings_pw_policy_ocredit }} \
-                                                            lcredit={{ settings_pw_policy_lcredit }} \
-                                                            minclass={{ settings_pw_policy_minclass }} \
-                                                            maxrepeat={{ settings_pw_policy_maxrepeat }} \
-                                                            maxclassrepeat={{ settings_pw_policy_maxclassrepeat }} \
-                                                            gecoscheck={{ settings_pw_policy_gecoscheck }}
+                                                            difok={{ password_policy_difok }} \
+                                                            minlen={{ password_policy_minlen }} \
+                                                            dcredit={{ password_policy_dcredit }} \
+                                                            ucredit={{ password_policy_ucredit }} \
+                                                            ocredit={{ password_policy_ocredit }} \
+                                                            lcredit={{ password_policy_lcredit }} \
+                                                            minclass={{ password_policy_minclass }} \
+                                                            maxrepeat={{ password_policy_maxrepeat }} \
+                                                            maxclassrepeat={{ password_policy_maxclassrepeat }} \
+                                                            gecoscheck={{ password_policy_gecoscheck }}
 {% else %}
 -password  [success=1 default=ignore]  pam_systemd_home.so
 {% endif %}
 password   required                    pam_unix.so          try_first_pass \
                                                             nullok \
                                                             shadow \
-                                                            minlen={{ settings_pw_policy_minlen }}
+                                                            minlen={{ password_policy_minlen }}
 password   optional                    pam_permit.so
 
 -session   optional                    pam_systemd_home.so
diff --git a/roles/settings/templates/debian-pam-pw.j2 b/roles/password_policy/templates/debian-pam-pw.j2
index 521b822a..dceedf97 100644
--- a/roles/settings/templates/debian-pam-pw.j2
+++ b/roles/password_policy/templates/debian-pam-pw.j2
@@ -22,21 +22,21 @@
 # pam-auth-update(8) for details.
 
 # here are the per-package modules (the "Primary" block)
-{% if settings_pw_policy_enabled %}
+{% if password_policy_enabled %}
 password        requisite                       pam_pwquality.so retry=3 \
-                                                                 difok={{ settings_pw_policy_difok }} \
-                                                                 minlen={{ settings_pw_policy_minlen }} \
-                                                                 dcredit={{ settings_pw_policy_dcredit }} \
-                                                                 ucredit={{ settings_pw_policy_ucredit }} \
-                                                                 ocredit={{ settings_pw_policy_ocredit }} \
-                                                                 lcredit={{ settings_pw_policy_lcredit }} \
-                                                                 minclass={{ settings_pw_policy_minclass }} \
-                                                                 maxrepeat={{ settings_pw_policy_maxrepeat }} \
-                                                                 maxclassrepeat={{ settings_pw_policy_maxclassrepeat }} \
-                                                                 gecoscheck={{ settings_pw_policy_gecoscheck }}
+                                                                 difok={{ password_policy_difok }} \
+                                                                 minlen={{ password_policy_minlen }} \
+                                                                 dcredit={{ password_policy_dcredit }} \
+                                                                 ucredit={{ password_policy_ucredit }} \
+                                                                 ocredit={{ password_policy_ocredit }} \
+                                                                 lcredit={{ password_policy_lcredit }} \
+                                                                 minclass={{ password_policy_minclass }} \
+                                                                 maxrepeat={{ password_policy_maxrepeat }} \
+                                                                 maxclassrepeat={{ password_policy_maxclassrepeat }} \
+                                                                 gecoscheck={{ password_policy_gecoscheck }}
 password        [success=1 default=ignore]      pam_unix.so obscure use_authtok try_first_pass yescrypt
 {% else %}
-password        [success=1 default=ignore]      pam_unix.so obsecure sha512 minlen={{ settings_pw_policy_minlen }}
+password        [success=1 default=ignore]      pam_unix.so obsecure sha512 minlen={{ password_policy_minlen }}
 {% endif %}
 # here's the fallback if no module succeeds
 password        requisite                       pam_deny.so
diff --git a/roles/password_policy/vars/archlinux.yml b/roles/password_policy/vars/archlinux.yml
new file mode 100644
index 00000000..59d439d6
--- /dev/null
+++ b/roles/password_policy/vars/archlinux.yml
@@ -0,0 +1,2 @@
+---
+password_policy_pkg: "libpwquality"
diff --git a/roles/password_policy/vars/debian.yml b/roles/password_policy/vars/debian.yml
new file mode 100644
index 00000000..cb52b37d
--- /dev/null
+++ b/roles/password_policy/vars/debian.yml
@@ -0,0 +1,2 @@
+---
+password_policy_pkg: "libpam-pwquality"
diff --git a/roles/settings/README.md b/roles/settings/README.md
deleted file mode 100644
index 9f6c7bb9..00000000
--- a/roles/settings/README.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# Ansible Role: settings
-
-This role configure the machine settings (locales/timezone/password policy/etc.)
-
-## Role Variables
-
-- `settings_timezone` the timezone default `CET`
-
-- `settings_pw_policy_enabled` boolean to enable or disable the enforcement of password policy
-- `settings_pw_policy_difok` the number of differences between new and old password (default 0 - disabled)
-- `settings_pw_policy_minlen` min password length (default 8)
-- `settings_pw_policy_dcredit` required digits in password (default 0)
-- `settings_pw_policy_ucredit` required uppercase chars in password (default 0)
-- `settings_pw_policy_ocredit` required other chars in password (default 0)
-- `settings_pw_policy_lcredit` required lowercase chars in password (default 0)
-- `settings_pw_policy_minclass` required minimum classes in password upper/lower/digit/other (default 0 - disabled)
-- `settings_pw_policy_maxrepeat` allowed maximum repeats in password (default 0 - disabled)
-- `settings_pw_policy_maxclassrepeat` maximum allowed consecutive class repeats (default 0 -disabled)
-- `settings_pw_policy_gecoscheck` (default 0 - disabled)
-
-## Docs
-
-- https://linux.die.net/man/8/pam_pwquality
diff --git a/roles/settings/defaults/main.yml b/roles/settings/defaults/main.yml
deleted file mode 100644
index a7001ab0..00000000
--- a/roles/settings/defaults/main.yml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-# Password policy
-# https://linux.die.net/man/8/pam_pwquality
-settings_pw_policy_enabled: true
-settings_pw_policy_difok: 0
-settings_pw_policy_minlen: 8
-settings_pw_policy_dcredit: 0
-settings_pw_policy_ucredit: 0
-settings_pw_policy_ocredit: 0
-settings_pw_policy_lcredit: 0
-settings_pw_policy_minclass: 0
-settings_pw_policy_maxrepeat: 0
-settings_pw_policy_maxclassrepeat: 0
-settings_pw_policy_gecoscheck: 0
diff --git a/roles/settings/vars/archlinux.yml b/roles/settings/vars/archlinux.yml
deleted file mode 100644
index cbe08e80..00000000
--- a/roles/settings/vars/archlinux.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-settings_pw_quality: "libpwquality"
diff --git a/roles/settings/vars/debian.yml b/roles/settings/vars/debian.yml
deleted file mode 100644
index 6767ffd7..00000000
--- a/roles/settings/vars/debian.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-settings_pw_quality: "libpam-pwquality"