initial commit

roles/container_isolation/tasks/sync_users.yml

@@ -0,0 +1,49 @@
+---
+# roles/container_isolation/tasks/sync_users.yml
+#
+# Creates each app's primary group + user, and each shared group, using
+# Ansible's built-in group/user modules instead of hand-rolled file
+# appends — this is idempotent and safe to re-run, and avoids the
+# malformed-/etc/passwd risk of manual editing.
+
+- name: Create primary group for each container app
+  ansible.builtin.group:
+    name: "{{ item.name }}"
+    gid: "{{ item.uid }}"
+    state: present
+  loop: "{{ container_apps }}"
+  loop_control:
+    label: "{{ item.name }} (gid {{ item.uid }})"
+
+- name: Create shared (secondary) groups
+  ansible.builtin.group:
+    name: "{{ item.name }}"
+    gid: "{{ item.gid }}"
+    state: present
+  loop: "{{ shared_groups }}"
+  loop_control:
+    label: "{{ item.name }} (gid {{ item.gid }})"
+
+- name: Create service user for each container app
+  ansible.builtin.user:
+    name: "{{ item.name }}"
+    uid: "{{ item.uid }}"
+    group: "{{ item.name }}"
+    shell: /usr/sbin/nologin
+    home: /nonexistent
+    create_home: false
+    system: true
+    state: present
+  loop: "{{ container_apps }}"
+  loop_control:
+    label: "{{ item.name }} (uid {{ item.uid }})"
+
+- name: Add app users to their shared groups
+  ansible.builtin.user:
+    name: "{{ item.0.name }}"
+    groups: "{{ item.1.name }}"
+    append: true
+  loop: "{{ container_apps | product(shared_groups) | list }}"
+  loop_control:
+    label: "{{ item.0.name }} -> {{ item.1.name }}"
+  when: item.0.name in item.1.members