50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
---
|
|
# roles/container_isolation/tasks/sync_users.yml
|
|
#
|
|
# Creates each app's primary group + user, and each shared group, using
|
|
# Ansible's built-in group/user modules instead of hand-rolled file
|
|
# appends — this is idempotent and safe to re-run, and avoids the
|
|
# malformed-/etc/passwd risk of manual editing.
|
|
|
|
- name: Create primary group for each container app
|
|
ansible.builtin.group:
|
|
name: "{{ item.name }}"
|
|
gid: "{{ item.uid }}"
|
|
state: present
|
|
loop: "{{ container_apps }}"
|
|
loop_control:
|
|
label: "{{ item.name }} (gid {{ item.uid }})"
|
|
|
|
- name: Create shared (secondary) groups
|
|
ansible.builtin.group:
|
|
name: "{{ item.name }}"
|
|
gid: "{{ item.gid }}"
|
|
state: present
|
|
loop: "{{ shared_groups }}"
|
|
loop_control:
|
|
label: "{{ item.name }} (gid {{ item.gid }})"
|
|
|
|
- name: Create service user for each container app
|
|
ansible.builtin.user:
|
|
name: "{{ item.name }}"
|
|
uid: "{{ item.uid }}"
|
|
group: "{{ item.name }}"
|
|
shell: /usr/sbin/nologin
|
|
home: /nonexistent
|
|
create_home: false
|
|
system: true
|
|
state: present
|
|
loop: "{{ container_apps }}"
|
|
loop_control:
|
|
label: "{{ item.name }} (uid {{ item.uid }})"
|
|
|
|
- name: Add app users to their shared groups
|
|
ansible.builtin.user:
|
|
name: "{{ item.0.name }}"
|
|
groups: "{{ item.1.name }}"
|
|
append: true
|
|
loop: "{{ container_apps | product(shared_groups) | list }}"
|
|
loop_control:
|
|
label: "{{ item.0.name }} -> {{ item.1.name }}"
|
|
when: item.0.name in item.1.members
|