ansible/roles/autofs/tasks/main.yml

82 lines
2.1 KiB
YAML

---
- name: Install packages
ansible.builtin.package:
name: autofs
state: installed
- name: Allow NFS home directories for SELinux
ansible.posix.seboolean:
name: use_nfs_home_dirs
state: true
persistent: true
- name: Configure LDAP server for autofs
ansible.builtin.lineinfile:
dest: /etc/autofs.conf
regexp: '^#?ldap_uri\s*=.*'
line: "ldap_uri = {% for u in ldap_server %}ldaps://{{ u }} {% endfor %}"
notify: Restart autofs
- name: Configure LDAP schema for autofs
ansible.builtin.lineinfile:
dest: /etc/autofs.conf
line: "{{ item }}"
insertbefore: "^# auth_conf_file"
notify: Restart autofs
with_items:
- value_attribute = automountInformation
- entry_attribute = automountKey
- map_attribute = ou
- entry_object_class = automount
- map_object_class = organizationalUnit
- name: Configure LDAP auth for autofs
ansible.builtin.template:
dest: /etc/autofs_ldap_auth.conf
src: autofs_ldap_auth.conf.j2
mode: "0600"
owner: root
group: "{{ ansible_wheel }}"
notify: Restart autofs
- name: Create auto.master config
ansible.builtin.template:
dest: /etc/auto.master
src: auto.master.j2
mode: "0644"
owner: root
group: "{{ ansible_wheel }}"
notify: Restart autofs
- name: Start autofs service
ansible.builtin.service:
name: autofs
state: started
enabled: true
- name: Disable authorized_keys file from users
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
line: AuthorizedKeysFile none
regexp: '^AuthorizedKeysFile\s+.*'
notify: Restart sshd
- name: Enable authorized_keys file for root
ansible.builtin.blockinfile:
path: /etc/ssh/sshd_config
block: |
Match User root
AuthorizedKeysFile .ssh/authorized_keys
marker: "# {mark} ANSIBLE MANAGED BLOCK (root user)"
notify: Restart sshd
- name: Move user cache from home directory to tmpfs
ansible.builtin.copy:
dest: "/etc/profile.d/{{ item }}"
src: "{{ item }}"
mode: "0644"
owner: root
group: "{{ ansible_wheel }}"
with_items:
- usercache.sh
- usercache.csh