89 lines
2.2 KiB
YAML
89 lines
2.2 KiB
YAML
---
|
|
- name: "Use custom Ubuntu mirror"
|
|
ansible.builtin.replace:
|
|
path: /etc/apt/sources.list
|
|
regexp: 'https://tormakris.jfrog.io/artifactory/ubuntu-mirror'
|
|
replace: 'https://mirror.niif.hu'
|
|
backup: yes
|
|
|
|
- name: "Use custom Ubuntu mirror"
|
|
ansible.builtin.replace:
|
|
path: /etc/apt/sources.list
|
|
regexp: 'http://hu.archive.ubuntu.com'
|
|
replace: 'https://mirror.niif.hu'
|
|
backup: yes
|
|
|
|
- name: "Update machine"
|
|
ansible.builtin.apt:
|
|
update_cache: yes
|
|
upgrade: "yes"
|
|
autoclean: yes
|
|
autoremove: yes
|
|
|
|
- name: "Install realmd and dependencies"
|
|
ansible.builtin.apt:
|
|
update_cache: yes
|
|
state: present
|
|
name:
|
|
- realmd
|
|
- sssd
|
|
- sssd-tools
|
|
- libnss-sss
|
|
- libpam-sss
|
|
- adcli
|
|
- samba-common-bin
|
|
- oddjob
|
|
- oddjob-mkhomedir
|
|
- packagekit
|
|
|
|
- name: "Get join password from local environment variable"
|
|
ansible.builtin.set_fact:
|
|
join_passw: "{{ lookup('env', 'JOIN_PASSW') }}"
|
|
delegate_to: localhost
|
|
|
|
- name: Join to AD with realmd
|
|
ansible.builtin.shell:
|
|
cmd: echo -e {{ join_passw }} | realm join -v -U Administrator intra.tormakris.dev
|
|
|
|
- name: Enable pam homedir create on first logon
|
|
ansible.builtin.command:
|
|
cmd: pam-auth-update --enable mkhomedir
|
|
|
|
- name: Check if ad_gpo_access_control is disabled
|
|
ansible.builtin.lineinfile:
|
|
state: absent
|
|
path: /etc/sssd/sssd.conf
|
|
regexp: "^ad_gpo_access_control"
|
|
check_mode: true
|
|
changed_when: false
|
|
register: checkadgpoac
|
|
|
|
- name: Set ad_gpo_access_control to disabled
|
|
ansible.builtin.lineinfile:
|
|
state: present
|
|
path: /etc/sssd/sssd.conf
|
|
line: "ad_gpo_access_control = disabled"
|
|
when: checkadgpoac.found == 0
|
|
|
|
- name: Check if ad_access_filter is set
|
|
ansible.builtin.lineinfile:
|
|
state: absent
|
|
path: /etc/sssd/sssd.conf
|
|
regexp: "^ad_access_filter"
|
|
check_mode: true
|
|
changed_when: false
|
|
register: checkadaf
|
|
|
|
- name: Set ad_gpo_access_control to disabled
|
|
ansible.builtin.lineinfile:
|
|
state: present
|
|
path: /etc/sssd/sssd.conf
|
|
line: "ad_access_filter = memberOf=CN=LinuxUsers,OU=Service Groups,DC=intra,DC=tormakris,DC=dev"
|
|
when: checkadaf.found == 0
|
|
|
|
- name: "Restart sssd"
|
|
ansible.builtin.service:
|
|
name: sssd
|
|
state: restarted
|
|
...
|