initial commit

roles/container_isolation/tasks/jerick_access.yml

@@ -0,0 +1,45 @@
+---
+# roles/container_isolation/tasks/jerick_access.yml
+#
+# jerick needs read-write access across every app folder for admin/
+# maintenance purposes, without weakening isolation between apps from
+# each other. Achieved by making jerick a secondary member of every
+# app's primary group, combined with 770 permissions on app folders
+# (see nfs_folders.yml) — owner: full access, group (incl. jerick):
+# full access, others: none.
+
+- name: Check whether jerick exists on this host (read-only, does not create the account)
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ jerick_user }}"
+  register: jerick_lookup
+  failed_when: false
+
+- name: Warn if jerick user does not exist on this host
+  ansible.builtin.debug:
+    msg: >-
+      WARNING: user '{{ jerick_user }}' was not found on this host.
+      This role does not create jerick's account (assumed to be a
+      pre-existing human user, not a service account). Create it first,
+      then re-run this role so jerick gets added to the app groups below.
+  when: jerick_lookup.failed | default(false)
+
+- name: Add jerick to every app's primary group
+  ansible.builtin.user:
+    name: "{{ jerick_user }}"
+    groups: "{{ item.name }}"
+    append: true
+  loop: "{{ container_apps }}"
+  loop_control:
+    label: "{{ jerick_user }} -> {{ item.name }}"
+  when: not (jerick_lookup.failed | default(false))
+
+- name: Add jerick to every shared group
+  ansible.builtin.user:
+    name: "{{ jerick_user }}"
+    groups: "{{ item.name }}"
+    append: true
+  loop: "{{ shared_groups }}"
+  loop_control:
+    label: "{{ jerick_user }} -> {{ item.name }}"
+  when: not (jerick_lookup.failed | default(false))