initial commit

roles/container_isolation/tasks/jerick_access.yml

@@ -0,0 +1,45 @@
+---
+# roles/container_isolation/tasks/jerick_access.yml
+#
+# jerick needs read-write access across every app folder for admin/
+# maintenance purposes, without weakening isolation between apps from
+# each other. Achieved by making jerick a secondary member of every
+# app's primary group, combined with 770 permissions on app folders
+# (see nfs_folders.yml) — owner: full access, group (incl. jerick):
+# full access, others: none.
+
+- name: Check whether jerick exists on this host (read-only, does not create the account)
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ jerick_user }}"
+  register: jerick_lookup
+  failed_when: false
+
+- name: Warn if jerick user does not exist on this host
+  ansible.builtin.debug:
+    msg: >-
+      WARNING: user '{{ jerick_user }}' was not found on this host.
+      This role does not create jerick's account (assumed to be a
+      pre-existing human user, not a service account). Create it first,
+      then re-run this role so jerick gets added to the app groups below.
+  when: jerick_lookup.failed | default(false)
+
+- name: Add jerick to every app's primary group
+  ansible.builtin.user:
+    name: "{{ jerick_user }}"
+    groups: "{{ item.name }}"
+    append: true
+  loop: "{{ container_apps }}"
+  loop_control:
+    label: "{{ jerick_user }} -> {{ item.name }}"
+  when: not (jerick_lookup.failed | default(false))
+
+- name: Add jerick to every shared group
+  ansible.builtin.user:
+    name: "{{ jerick_user }}"
+    groups: "{{ item.name }}"
+    append: true
+  loop: "{{ shared_groups }}"
+  loop_control:
+    label: "{{ jerick_user }} -> {{ item.name }}"
+  when: not (jerick_lookup.failed | default(false))

roles/container_isolation/tasks/main.yml

@@ -0,0 +1,9 @@
+---
+# roles/container_isolation/tasks/main.yml
+
+- name: Sync container service groups and users (all hosts)
+  import_tasks: sync_users.yml
+
+- name: Add jerick to every app and shared group (all hosts)
+  import_tasks: jerick_access.yml
+

roles/container_isolation/tasks/sync_users.yml

@@ -0,0 +1,49 @@
+---
+# roles/container_isolation/tasks/sync_users.yml
+#
+# Creates each app's primary group + user, and each shared group, using
+# Ansible's built-in group/user modules instead of hand-rolled file
+# appends — this is idempotent and safe to re-run, and avoids the
+# malformed-/etc/passwd risk of manual editing.
+
+- name: Create primary group for each container app
+  ansible.builtin.group:
+    name: "{{ item.name }}"
+    gid: "{{ item.uid }}"
+    state: present
+  loop: "{{ container_apps }}"
+  loop_control:
+    label: "{{ item.name }} (gid {{ item.uid }})"
+
+- name: Create shared (secondary) groups
+  ansible.builtin.group:
+    name: "{{ item.name }}"
+    gid: "{{ item.gid }}"
+    state: present
+  loop: "{{ shared_groups }}"
+  loop_control:
+    label: "{{ item.name }} (gid {{ item.gid }})"
+
+- name: Create service user for each container app
+  ansible.builtin.user:
+    name: "{{ item.name }}"
+    uid: "{{ item.uid }}"
+    group: "{{ item.name }}"
+    shell: /usr/sbin/nologin
+    home: /nonexistent
+    create_home: false
+    system: true
+    state: present
+  loop: "{{ container_apps }}"
+  loop_control:
+    label: "{{ item.name }} (uid {{ item.uid }})"
+
+- name: Add app users to their shared groups
+  ansible.builtin.user:
+    name: "{{ item.0.name }}"
+    groups: "{{ item.1.name }}"
+    append: true
+  loop: "{{ container_apps | product(shared_groups) | list }}"
+  loop_control:
+    label: "{{ item.0.name }} -> {{ item.1.name }}"
+  when: item.0.name in item.1.members