46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
---
|
|
# roles/container_isolation/tasks/jerick_access.yml
|
|
#
|
|
# jerick needs read-write access across every app folder for admin/
|
|
# maintenance purposes, without weakening isolation between apps from
|
|
# each other. Achieved by making jerick a secondary member of every
|
|
# app's primary group, combined with 770 permissions on app folders
|
|
# (see nfs_folders.yml) — owner: full access, group (incl. jerick):
|
|
# full access, others: none.
|
|
|
|
- name: Check whether jerick exists on this host (read-only, does not create the account)
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ jerick_user }}"
|
|
register: jerick_lookup
|
|
failed_when: false
|
|
|
|
- name: Warn if jerick user does not exist on this host
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
WARNING: user '{{ jerick_user }}' was not found on this host.
|
|
This role does not create jerick's account (assumed to be a
|
|
pre-existing human user, not a service account). Create it first,
|
|
then re-run this role so jerick gets added to the app groups below.
|
|
when: jerick_lookup.failed | default(false)
|
|
|
|
- name: Add jerick to every app's primary group
|
|
ansible.builtin.user:
|
|
name: "{{ jerick_user }}"
|
|
groups: "{{ item.name }}"
|
|
append: true
|
|
loop: "{{ container_apps }}"
|
|
loop_control:
|
|
label: "{{ jerick_user }} -> {{ item.name }}"
|
|
when: not (jerick_lookup.failed | default(false))
|
|
|
|
- name: Add jerick to every shared group
|
|
ansible.builtin.user:
|
|
name: "{{ jerick_user }}"
|
|
groups: "{{ item.name }}"
|
|
append: true
|
|
loop: "{{ shared_groups }}"
|
|
loop_control:
|
|
label: "{{ jerick_user }} -> {{ item.name }}"
|
|
when: not (jerick_lookup.failed | default(false))
|