vh
8c32a0540f
Adds a host-agnostic elway play + fleet driver that stand up an `infra-ops` system user (dedicated ed25519 key, NOPASSWD sudo with log_output audit, docker group) so the infra-ops agent completes DevOps work end-to-end instead of handing sudo steps back to the operator. Scoped to PFI-owned Linux boxes; tiered (compute/app/ sensitive-infra) with SureFire/corviduo/esh/Synology explicitly excluded. Validated live on irv-ml1.
78 lines
3.5 KiB
YAML
78 lines
3.5 KiB
YAML
# Bootstrap the `infra-ops` agent identity on a PFI-OWNED box.
|
|
#
|
|
# Creates a dedicated, key-authenticated, NOPASSWD-sudo system user so the
|
|
# infra-ops agent can complete DevOps work (apt, systemctl, service lifecycle)
|
|
# end-to-end instead of handing sudo steps back to the operator.
|
|
#
|
|
# WHY a dedicated identity (not the agent borrowing lkraven/vh sudo):
|
|
# - Clean audit trail — every agent action attributable to `infra-ops`,
|
|
# separate from human accounts, with sudo I/O logging on.
|
|
# - Revocation = pull one authorized_keys line + one sudoers file.
|
|
# - No human password ever in the agent's reach (key-gated NOPASSWD).
|
|
#
|
|
# RUN (operator, with YOUR sudo — infra-ops doesn't exist yet, so you bootstrap
|
|
# it as your normal account; elway prompts for your sudo password once, lazily
|
|
# on the first sudo step):
|
|
# scripts/elway <pfi-host> --playbook playbooks/bootstrap-infra-ops-user.yaml
|
|
# Fleet (a lot of servers):
|
|
# scripts/bootstrap-infra-ops-fleet.sh
|
|
#
|
|
# SCOPE — PFI-owned Linux boxes ONLY. NEVER run on:
|
|
# - SureFire sf-* / sfsrv-ana (tenant property — coordinate, don't own)
|
|
# - corviduo-dev (Worldtree partner app-layer)
|
|
# - esh-* (ESH home lab — non-PFI)
|
|
# - nh3-nas (Synology DSM) (no standard useradd / sudoers.d)
|
|
#
|
|
# Idempotent: re-running reconciles the key + sudoers without error.
|
|
|
|
vars:
|
|
ops_user: infra-ops
|
|
ops_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet"
|
|
# Optional authorized_keys from="..." source restriction. Empty = none.
|
|
# Hardening follow-up once per-path source IPs (LAN vs WG tunnel) are pinned.
|
|
ssh_from: ""
|
|
|
|
steps:
|
|
- name: Create the infra-ops system user (home + bash shell)
|
|
sudo: true
|
|
shell: useradd -m -s /bin/bash {{ ops_user }}
|
|
when: "! id {{ ops_user }} >/dev/null 2>&1"
|
|
|
|
- name: Add infra-ops to the docker group (only if docker is installed)
|
|
sudo: true
|
|
shell: getent group docker >/dev/null && usermod -aG docker {{ ops_user }} || echo "no docker group — skipped"
|
|
|
|
- name: Ensure infra-ops ~/.ssh exists (700, owned)
|
|
sudo: true
|
|
shell: install -d -m 700 -o {{ ops_user }} -g {{ ops_user }} /home/{{ ops_user }}/.ssh
|
|
|
|
- name: Install infra-ops authorized_keys (exact line, mode 600)
|
|
sudo: true
|
|
shell: |
|
|
line='{{ ops_pubkey }}'
|
|
[ -n '{{ ssh_from }}' ] && line='from="{{ ssh_from }}" {{ ops_pubkey }}'
|
|
printf '%s\n' "$line" > /home/{{ ops_user }}/.ssh/authorized_keys
|
|
chown {{ ops_user }}:{{ ops_user }} /home/{{ ops_user }}/.ssh/authorized_keys
|
|
chmod 600 /home/{{ ops_user }}/.ssh/authorized_keys
|
|
|
|
- name: Install NOPASSWD sudoers + command logging (visudo-validated before install)
|
|
sudo: true
|
|
shell: |
|
|
f=/etc/sudoers.d/{{ ops_user }}
|
|
printf 'Defaults:%s log_output\n%s ALL=(ALL) NOPASSWD:ALL\n' '{{ ops_user }}' '{{ ops_user }}' > "$f.tmp"
|
|
chmod 440 "$f.tmp"
|
|
if visudo -cf "$f.tmp"; then mv "$f.tmp" "$f"; else rm -f "$f.tmp"; echo "VISUDO VALIDATION FAILED"; exit 1; fi
|
|
|
|
verify:
|
|
- name: infra-ops user exists
|
|
shell: id {{ ops_user }}
|
|
changed_when: "false"
|
|
- name: authorized_keys present, mode 600, correct key
|
|
sudo: true
|
|
shell: test "$(stat -c %a /home/{{ ops_user }}/.ssh/authorized_keys)" = 600 && grep -q 'infra-ops@pfi-fleet' /home/{{ ops_user }}/.ssh/authorized_keys
|
|
changed_when: "false"
|
|
- name: sudoers file valid + NOPASSWD present
|
|
sudo: true
|
|
shell: visudo -cf /etc/sudoers.d/{{ ops_user }} && grep -q 'NOPASSWD:ALL' /etc/sudoers.d/{{ ops_user }}
|
|
changed_when: "false"
|