diff options
| author | Dmitry Ilvokhin <d@ilvokhin.com> | 2024-01-06 18:31:09 +0000 |
|---|---|---|
| committer | Dmitry Ilvokhin <d@ilvokhin.com> | 2024-01-06 18:31:09 +0000 |
| commit | a2f60b8691706d67c1b5446a78f8bebd541f554c (patch) | |
| tree | 1ad6835d702d361805f2c04ff5a2babbb0c71076 /roles/sudo/tasks | |
| parent | db46530e3349439f4417efab5af7b38e1ad928d1 (diff) | |
| download | infra-a2f60b8691706d67c1b5446a78f8bebd541f554c.tar.gz infra-a2f60b8691706d67c1b5446a78f8bebd541f554c.tar.bz2 infra-a2f60b8691706d67c1b5446a78f8bebd541f554c.zip | |
Migrate essential role to playbook completely
Diffstat (limited to 'roles/sudo/tasks')
| -rw-r--r-- | roles/sudo/tasks/main.yml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/roles/sudo/tasks/main.yml b/roles/sudo/tasks/main.yml new file mode 100644 index 0000000..e2d4861 --- /dev/null +++ b/roles/sudo/tasks/main.yml @@ -0,0 +1,31 @@ +- name: Install sudo + ansible.builtin.package: + name: + - sudo + state: present + +- name: Allow wheel group to use sudo + ansible.builtin.lineinfile: + dest: /etc/sudoers + state: present + regexp: '^(# )?%wheel ALL=\(ALL:ALL\) NOPASSWD: ALL' + line: '%wheel ALL=(ALL:ALL) NOPASSWD: ALL' + validate: "visudo -cf %s" + owner: root + group: root + mode: u+r,g+r,o-rwx + +- name: Use hard-coded PATH instead of the user's to find commands + ansible.builtin.lineinfile: + dest: /etc/sudoers + state: present + # Double quotes are important here if we want to break the line on multiple + # lines, as escaping doesn't work with single quotes. + regexp: "^(# )?Defaults secure_path=\"/usr/local/sbin:/usr/local/bin:\ + /usr/sbin:/usr/bin:/sbin:/bin\"" + line: "Defaults secure_path=\"/usr/local/sbin:/usr/local/bin:\ + /usr/sbin:/usr/bin:/sbin:/bin\"" + validate: "visudo -cf %s" + owner: root + group: root + mode: u+r,g+r,o-rwx |