From ef87b638cda732def492e97f8f5cc231436e7397 Mon Sep 17 00:00:00 2001 From: Greg Harvey Date: Thu, 13 Feb 2025 10:28:48 +0100 Subject: [PATCH 1/4] Fixing local linting. --- .ansible-lint | 1 + git-hooks/pre-push.d/ansible-lint.hook | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.ansible-lint b/.ansible-lint index 02d2d1c31..01ae8b32c 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -14,5 +14,6 @@ skip_list: - template-instead-of-copy # to skip over roles/ssl/tasks/copy.yml errors, temporarily. - name[template] # it doesn't like Jinja templates being in the middle of a task name, which seems silly to me. - name[casing] # sometimes included Galaxy roles break linting rules and cause failures + - args[module] # causing odd issue with ACL role exclude_paths: - roles/contrib/ # we don't control these roles diff --git a/git-hooks/pre-push.d/ansible-lint.hook b/git-hooks/pre-push.d/ansible-lint.hook index 2d978cb81..890f3345f 100755 --- a/git-hooks/pre-push.d/ansible-lint.hook +++ b/git-hooks/pre-push.d/ansible-lint.hook @@ -23,7 +23,7 @@ for file in $(git diff "$1/$BASE_BRANCH" --name-only --staged); do case $file in "$ROLE"*) printf "\e[36m Running Ansible linter against the\e[1m %s\e[0m\e[36m role. \e[0m \n" "$ROLE" - ANSIBLE_LINT_CMD="$DOCKER_CMD $ANSIBLE_LINT $CONTAINER_BASE_PATH/$ROLE" + ANSIBLE_LINT_CMD="$DOCKER_CMD $ANSIBLE_LINT -q $CONTAINER_BASE_PATH/$ROLE" ERRORS=$($ANSIBLE_LINT_CMD | wc -l) if [ "$ERRORS" != "0" ]; then $ANSIBLE_LINT_CMD From f224ebd40f37ed0183909a23dd8537d5d39c22a2 Mon Sep 17 00:00:00 2001 From: Greg Harvey Date: Thu, 13 Feb 2025 10:46:15 +0100 Subject: [PATCH 2/4] Ignoring jinja spacing issues. --- .ansible-lint | 1 + 1 file changed, 1 insertion(+) diff --git a/.ansible-lint b/.ansible-lint index 01ae8b32c..c8310bf72 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -15,5 +15,6 @@ skip_list: - name[template] # it doesn't like Jinja templates being in the middle of a task name, which seems silly to me. - name[casing] # sometimes included Galaxy roles break linting rules and cause failures - args[module] # causing odd issue with ACL role + - jinja[spacing] # pendantic! we get these from GitHub Actions anyway exclude_paths: - roles/contrib/ # we don't control these roles From 43ebf18927a0154998ca7127dafb282b3bac856b Mon Sep 17 00:00:00 2001 From: Greg Harvey Date: Thu, 19 Jun 2025 14:15:15 +0200 Subject: [PATCH 3/4] Upgrading to ce-dev 2.x. --- ce-dev/ce-dev.compose.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ce-dev/ce-dev.compose.yml b/ce-dev/ce-dev.compose.yml index c4a4e2188..dc2675206 100644 --- a/ce-dev/ce-dev.compose.yml +++ b/ce-dev/ce-dev.compose.yml @@ -1,19 +1,19 @@ x-ce_dev: - version: 1.x + version: 2.x registry: localhost:5000 project_name: provision provision: - ce-dev/ansible/setup.yml services: controller: - image: codeenigma/ce-dev-1.x:devel + image: codeenigma/ce-dev:2.x x-ce_dev: {} volumes: - ../:/home/ce-dev/ce-provision platform: linux/amd64 cgroup: host target: - image: codeenigma/ce-dev-1.x:devel + image: codeenigma/ce-dev:2.x x-ce_dev: host_aliases: - provision-target.local @@ -25,7 +25,7 @@ services: platform: linux/amd64 cgroup: host privileged: - image: codeenigma/ce-dev-1.x:devel + image: codeenigma/ce-dev:2.x x-ce_dev: host_aliases: - provision-privileged.local From 2e5c23721d2f1af159b4d6dab3771bf2b328a645 Mon Sep 17 00:00:00 2001 From: Greg Harvey Date: Thu, 19 Jun 2025 14:15:55 +0200 Subject: [PATCH 4/4] Allowing Ansible to create non-system users. --- roles/debian/user_ansible/defaults/main.yml | 5 +++-- roles/debian/user_ansible/tasks/main.yml | 6 +++--- roles/debian/user_deploy/defaults/main.yml | 3 ++- roles/debian/user_provision/defaults/main.yml | 3 ++- 4 files changed, 10 insertions(+), 7 deletions(-) diff --git a/roles/debian/user_ansible/defaults/main.yml b/roles/debian/user_ansible/defaults/main.yml index 5bec6c2c8..5357c1bf4 100644 --- a/roles/debian/user_ansible/defaults/main.yml +++ b/roles/debian/user_ansible/defaults/main.yml @@ -4,14 +4,15 @@ user_ansible: # This sets both username and main group. username: "{{ _user_ansible_username }}" home: "/home/{{ _user_ansible_username }}" - create: true # if you know the user already exists, set this to false to not create the user. + create: true # if you know the user already exists, set this to false to not create the user. create_home: true update_password: "always" + system_user: true # creates a system user - see useradd --system docs # It is often desirable to fix POSIX IDs for system users so they are consistent across your fleet # This is shown for documentation, you should do this in your config repo # uid: 999 # gid: 999 - sudo_config: {} # an empty dictionary will skip creating a sudo config + sudo_config: {} # an empty dictionary will skip creating a sudo config # Example sudo config allowing full sudo permissions - see the debian/sudo_config role for more details. # entity_name: "{{ _user_ansible_username }}" # hosts: "ALL" diff --git a/roles/debian/user_ansible/tasks/main.yml b/roles/debian/user_ansible/tasks/main.yml index 454906b3e..93290f410 100644 --- a/roles/debian/user_ansible/tasks/main.yml +++ b/roles/debian/user_ansible/tasks/main.yml @@ -3,13 +3,13 @@ ansible.builtin.group: name: "{{ user_ansible.username }}" gid: "{{ user_ansible.gid | default(omit) }}" - system: true + system: "{{ user_ansible.system_user }}" - name: Create additional groups. ansible.builtin.group: name: "{{ group }}" state: present - system: true + system: "{{ user_ansible.system_user }}" with_items: "{{ user_ansible.groups }}" loop_control: loop_var: group @@ -21,7 +21,7 @@ shell: /bin/bash group: "{{ user_ansible.username }}" uid: "{{ user_ansible.uid | default(omit) }}" - system: true + system: "{{ user_ansible.system_user }}" create_home: "{{ user_ansible.create_home }}" home: "{{ user_ansible.home }}" password: "*" diff --git a/roles/debian/user_deploy/defaults/main.yml b/roles/debian/user_deploy/defaults/main.yml index 718004a07..bd9aa0ac7 100644 --- a/roles/debian/user_deploy/defaults/main.yml +++ b/roles/debian/user_deploy/defaults/main.yml @@ -5,9 +5,10 @@ user_deploy: # If you are using ce-deploy to deploy code this must match the `deploy_user` variable username: "{{ _user_deploy_username }}" home: "/home/{{ _user_deploy_username }}" - create: true # if you know the user already exists, set this to false to not create the user. + create: true # if you know the user already exists, set this to false to not create the user. create_home: true update_password: "always" + system_user: true # creates a system user - see useradd --system docs # It is often desirable to fix POSIX IDs for system users so they are consistent across your fleet # This is shown for documentation, you should do this in your config repo # uid: 989 diff --git a/roles/debian/user_provision/defaults/main.yml b/roles/debian/user_provision/defaults/main.yml index 6039727a2..177d2e74b 100644 --- a/roles/debian/user_provision/defaults/main.yml +++ b/roles/debian/user_provision/defaults/main.yml @@ -4,9 +4,10 @@ user_provision: # This sets both username and main group. username: "{{ _user_provision_username }}" home: "/home/{{ _user_provision_username }}" - create: true # if you know the user already exists, set this to false to not create the user. + create: true # if you know the user already exists, set this to false to not create the user. create_home: true update_password: "always" + system_user: true # creates a system user - see useradd --system docs # It is often desirable to fix POSIX IDs for system users so they are consistent across your fleet # This is shown for documentation, you should do this in your config repo # uid: 988