setup.yml

---
- name: verify dependencies
  hosts: localhost
  gather_facts: no
  tasks:
    - fail:
        msg: passlib not installed
      when: "lookup('pipe', 'pip freeze | grep -q passlib; echo $?') | int != 0"
- name: install packages
  hosts: digitalocean
  gather_facts: no
  become: yes
  tasks:
    - name: install apt packages
      apt: "name={{ item }} update_cache=yes"
      with_items:
        - sudo
        - ruby-full
    - name: install pip
      easy_install: name=pip
    - name: install pip packages
      pip: "name={{ item }}"
      with_items:
        - pexpect
- name: manage users
  hosts: digitalocean
  gather_facts: no
  become: yes
  vars:
    prompt_password: ./password_input.py "password for %s:"
    users:
      - kacchan
    removed_users: []
  tasks:
    - name: remove users
      user:
        name: "{{ item }}"
        state: absent
        remove: yes
      with_items: "{{ removed_users }}"
    - name: create users
      user:
        name: "{{ item }}"
        shell: /bin/bash
        groups:
          - sudo
        append: yes
      with_items: "{{ users | difference(removed_users) }}"
      register: create_result
    - name: set new user passwords
      user:
        name: "{{ item }}"
        password: "{{ lookup('pipe', prompt_password | format(item)) | password_hash('sha512') }}"
      with_items: "{{ create_result.results | selectattr('changed') | map(attribute='item') | list }}"
      register: set_passwords_result
      ignore_errors: yes
    - name: make .ssh directory
      file:
        path: "/home/{{ item }}/.ssh"
        state: directory
      with_items: "{{ users | difference(removed_users) }}"
    - name: copy authorized_keys
      copy:
        src: "{{ item }}/authorized_keys"
        dest: "/home/{{ item }}/.ssh/authorized_keys"
      with_items: "{{ users | difference(removed_users) }}"
- name: configure docker
  hosts: digitalocean
  become: yes
  tasks:
    - name: remove deprecated docker packages
      apt: "name={{ item }} state=absent"
      with_items:
        - docker
        - docker-engine
    - name: install packages required to add repository
      apt: "name={{ item }} update_cache=yes"
      with_items:
        - apt-transport-https
        - ca-certificates
        - curl
        - gnupg2
        - software-properties-common
    - name: add key
      apt_key:
        url: https://download.docker.com/linux/debian/gpg
        id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
    - name: add repository
      apt_repository:
        repo: "deb [arch=amd64] https://download.docker.com/linux/debian {{ ansible_lsb.codename }} stable"
    - name: install docker
      apt: name=docker-ce update_cache=yes
    - name: install docker-py
      pip: name=docker-py
- name: configure app user
  hosts: digitalocean
  gather_facts: no
  become: yes
  tasks:
    - name: create docker group
      group:
        name: docker
    - name: create app user
      user:
        name: app
        shell: /bin/bash
        groups:
          - docker
        uid: 1001
        append: yes
- name: configure pki
  hosts: digitalocean
  gather_facts: no
  become: yes
  become_user: app
  vars:
    directory: /home/app/pki
  tasks:
    - name: make pki directory
      file:
        path: "{{ directory }}"
        state: directory
    - name: generate server key
      openssl_privatekey:
        path: "{{ directory }}/server.key.pem"
      register: generate_server_key_result
    - block:
        - name: generate server csr
          openssl_csr:
            force: yes
            privatekey_path: "{{ directory }}/server.key.pem"
            CN: "{{ ansible_hostname }}"
            path: "/tmp/{{ inventory_hostname }}-server.csr"
        - name: fetch server csr
          fetch:
            src: "/tmp/{{ inventory_hostname }}-server.csr"
            dest: files/certs/
            flat: yes
        - name: sign server cert
          command: "rake ca:sign[files/certs/{{ inventory_hostname }}-server]"
          delegate_to: localhost
          connection: local
          become: false
      when: generate_server_key_result.changed
    - name: copy ca cert
      copy:
        src: files/pki/cacert.pem
        dest: "{{ directory }}/ca.cert.pem"
    - name: copy crl
      copy:
        src: files/pki/crl.pem
        dest: "{{ directory }}/crl.pem"
- name: configure ssh
  hosts: digitalocean
  gather_facts: no
  become: yes
  tasks:
    - name: disable root login
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^PermitRootLogin "
        line: "PermitRootLogin no"
      register: disable_root_login_result
    - name: disable password authentication
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^PasswordAuthentication "
        line: "PasswordAuthentication no"
      register: disable_password_authentication_result
    - name: restart sshd
      systemd:
        name: ssh
        state: restarted
      when: disable_root_login_result.changed or disable_password_authentication_result.changed