secure.yml

---
- name: Bootstrap
  hosts: all
  become: yes
  become_user: root
  vars_files:
    - vars.yml

  tasks:
    - name: Set Hostname
      hostname: name={{ pi_name }}
      notify: Remove singleton

    - name: Set Timezone
      timezone: name={{ timezone }}

    - name: Setup Admin group
      group:
            name: admin
            state: present

    - name: Create new user
      user: name={{ server_user_name }}
            password={{ server_user_password |password_hash('md5') }}
            shell=/bin/bash
            groups=admin
            update_password=on_create

    - name: Add group to sudoers
      copy: dest=/etc/sudoers.d/admin-group-nopasswd
            content="%admin ALL=(ALL) NOPASSWD:ALL"
            force=yes
            group=root
            owner=root
            mode=0440
            follow=yes

    - name: Add authorized_keys for the user
      authorized_key: user={{ server_user_name }} key="{{ lookup('file', item) }}"
      with_items:
        - "{{ user_public_keys }}"

    - name: Disallow root SSH access
      action: lineinfile dest=/etc/ssh/sshd_config regexp="^PermitRootLogin" line="PermitRootLogin no" state=present
      notify: Restart ssh

    - name: Disallow password authentication
      action: lineinfile dest=/etc/ssh/sshd_config regexp="^PasswordAuthentication" line="PasswordAuthentication no" state=present
      notify: Restart ssh

    - name: Install required packages
      apt: state=installed pkg={{ item }}
      with_items:
      - "{{ required_packages }}"

    - name: Allow ssh and http(s) connections
      ufw: rule=allow port={{ item }}
      with_items:
        - "{{ ufw_allowed_ports }}"

    - name: Enable ufw/firewall
      ufw: state=enabled policy=deny

  handlers:
    - name: Restart ssh
      service: name=ssh state=restarted

    - name: Remove singleton
      include: tasks/rm_chrome_singleton.yml