EvoBSD/roles/base/tasks/sudo.yml

---
- name: "Configure sudoers umask"
  lineinfile:
    dest: /etc/sudoers
    insertafter: '# Defaults specification'
    line: 'Defaults umask=0077'
    validate: 'visudo -cf %s'
  tags:
    - sudo

- name: "Allow wheel group to run command as root in sudo"
  lineinfile:
    dest: /etc/sudoers
    insertafter: '# and set environment variables.'
    line: "%wheel\tALL=(ALL) SETENV: ALL"
    validate: 'visudo -cf %s'
    backup: false
  tags:
    - sudo

- name: "Delete line with space instead of tab"
  lineinfile:
    dest: /etc/sudoers
    line: "%wheel   ALL=(ALL) SETENV: ALL"
    validate: 'visudo -cf %s'
    backup: false
    state: absent
  tags:
    - sudo

- name: "Configure sudoers for evomaintenance and monitoring"
  blockinfile:
    state: present
    dest: /etc/sudoers
    insertafter: EOF
    block: |
      Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh
      %wheel ALL=NOPASSWD: MAINT
      %evolinux-sudo ALL=(ALL) SETENV: ALL
    validate: 'visudo -cf %s'
    backup: false
  tags:
    - sudo
Add initial project 2018-12-28 11:23:49 +01:00			`---`
Syntax : have all task name between quotes 2022-06-23 16:17:42 +02:00			`- name: "Configure sudoers umask"`
Configure sudoers umask This configuration is checked by evocheck, so it should be present by default 2020-10-08 15:42:52 +02:00			`lineinfile:`
			`dest: /etc/sudoers`
			`insertafter: '# Defaults specification'`
			`line: 'Defaults umask=0077'`
			`validate: 'visudo -cf %s'`
			`tags:`
			`- sudo`

Syntax : have all task name between quotes 2022-06-23 16:17:42 +02:00			`- name: "Allow wheel group to run command as root in sudo"`
Add initial project 2018-12-28 11:23:49 +01:00			`lineinfile:`
			`dest: /etc/sudoers`
			`insertafter: '# and set environment variables.'`
Do not use litteral tab in configuration Use "\t" instead of a litteral tab which can easily be broken. Also add a deletion of line with spaces. 2020-10-13 12:01:18 +02:00			`line: "%wheel\tALL=(ALL) SETENV: ALL"`
Add initial project 2018-12-28 11:23:49 +01:00			`validate: 'visudo -cf %s'`
Ansible-lint and yamllint again Lot of truthy variables, indentation and trailing spaces 2020-06-01 11:37:15 +02:00			`backup: false`
Add initial project 2018-12-28 11:23:49 +01:00			`tags:`
Ansible-lint and yamllint again Lot of truthy variables, indentation and trailing spaces 2020-06-01 11:37:15 +02:00			`- sudo`
Add initial project 2018-12-28 11:23:49 +01:00
Syntax : have all task name between quotes 2022-06-23 16:17:42 +02:00			`- name: "Delete line with space instead of tab"`
Do not use litteral tab in configuration Use "\t" instead of a litteral tab which can easily be broken. Also add a deletion of line with spaces. 2020-10-13 12:01:18 +02:00			`lineinfile:`
			`dest: /etc/sudoers`
			`line: "%wheel ALL=(ALL) SETENV: ALL"`
			`validate: 'visudo -cf %s'`
			`backup: false`
			`state: absent`
			`tags:`
			`- sudo`

Syntax : have all task name between quotes 2022-06-23 16:17:42 +02:00			`- name: "Configure sudoers for evomaintenance and monitoring"`
Add initial project 2018-12-28 11:23:49 +01:00			`blockinfile:`
			`state: present`
			`dest: /etc/sudoers`
			`insertafter: EOF`
			`block: \|`
			`Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh`
			`%wheel ALL=NOPASSWD: MAINT`
Allow evolinux-sudo group to sudo evolinux-sudo group can already use doas, it should also be allowed to use sudo 2020-10-22 11:28:06 +02:00			`%evolinux-sudo ALL=(ALL) SETENV: ALL`
Add initial project 2018-12-28 11:23:49 +01:00			`validate: 'visudo -cf %s'`
Ansible-lint and yamllint again Lot of truthy variables, indentation and trailing spaces 2020-06-01 11:37:15 +02:00			`backup: false`
Add initial project 2018-12-28 11:23:49 +01:00			`tags:`
Ansible-lint and yamllint again Lot of truthy variables, indentation and trailing spaces 2020-06-01 11:37:15 +02:00			`- sudo`