debops.system_users default variables

Global defaults

system_users__enabled

Should Ansible manage system user accounts? Set to False to disable.

system_users__enabled: True
system_users__acl_enabled

Enable or disable support for filesystem ACL management.

system_users__acl_enabled: '{{ True if ("acl" in system_users__base_packages) else False }}'
system_users__default_shell

Specify absolute path of the shell which should be configured on all user accounts managed by this role, if not overriden by the user configuration. If not specified, the shell won't be changed, but new accounts will not have a defined shell either.

system_users__default_shell: ''

APT packages

system_users__shell_package_map

YAML dictionary that maps known shells used in the /etc/passwd database to the APT packages with these shells. The role will install missing shell packages if any users have them as their login shells.

system_users__shell_package_map:
  '/bin/bash':     'bash'
  '/bin/csh':      'csh'
  '/usr/bin/fish': 'fish'
  '/bin/ksh':      'ksh'
  '/bin/zsh':      'zsh'
system_users__base_packages

List of base APT packages to install.

system_users__base_packages: [ 'acl' ]
system_users__shell_packages

List of login shell APT packages expected on the host.

system_users__shell_packages: '{{ lookup("template", "lookup/system_users__shell_packages.j2") | from_yaml }}'
system_users__packages

List of custom APT packages to install.

system_users__packages: []

Home directories, LDAP integration

system_users__prefix

Add a prefix to the custom UNIX system account names created by DebOps. By default, no prefix is added.

If the role detects that the LDAP support has been, or will be, enabled on a host by the debops.ldap Ansible role, custom UNIX account names created locally on the host will have the _ prefix to indicate that they are local to a given host and not create conflicts with any UNIX accounts defined in LDAP.

If the LDAP support was enabled after the system accounts have been created, the role will keep the current prefix value to not duplicate the UNIX accounts.

system_users__prefix: '{{ ansible_local.system_users.prefix
                          if (ansible_local|d() and ansible_local.system_users|d() and
                              ansible_local.system_users.prefix is defined)
                          else ("_"
                                if ("debops_service_ldap" in group_names or
                                    (ansible_local|d() and ansible_local.ldap|d() and
                                     (ansible_local.ldap.posix_enabled|d())|bool))
                                else "") }}'
system_users__home_root

The base path of the home directories for the UNIX accounts managed by DebOps. In the LDAP environment, the /home directory might be shared between multiple hosts and mounted from a remote location (for example NFS), therefore /var/local is used to avoid issues with the remote filesystem. The item.home parameter can be used to specify the home directory path and override the autogenerated one.

system_users__home_root: '{{ "/var/local"
                             if ("debops_service_ldap" in group_names or
                                 (ansible_local|d() and ansible_local.ldap|d() and
                                  (ansible_local.ldap.posix_enabled|d())|bool))
                             else "/home" }}'
system_users__default_home_mode

The default set of permissions for the home directories, specified in octal. It can be overridden on a per-account basis with the item.home_mode parameter.

system_users__default_home_mode: '0751'

Administrator account status

system_users__admin_groups

List of the UNIX groups to which the defined system administrator users (with the admin parameter) will be added by default. These groups grant privileged access to the root UNIX account, system logs and other important services.

system_users__admin_groups: '{{ ansible_local.system_groups.access.root
                                if (ansible_local.system_groups.access|d() and
                                    ansible_local.system_groups.access.root|d())
                                else [ "admins" ] }}'

User configuration files (dotfiles)

These variables are used to manage the user configuration files (dotfiles).

system_users__dotfiles_enabled

Enable or disable management of user dotfiles via yadm script. See the debops.yadm role for script installation and dotfile mirroring.

system_users__dotfiles_enabled: '{{ True
                                    if ansible_local.yadm.dotfiles|d()
                                    else False }}'
system_users__dotfiles_repo

An URL or an absolute path on the remote host to the git dotfiles repository. The repository will be used by default if the dotfiles management is enabled without specifying a custom repository for the user.

system_users__dotfiles_repo: '{{ ansible_local.yadm.dotfiles|d("") }}'

The "current Ansible user" configuration

system_users__self

Enable or disable management of the UNIX account for the "current Ansible user". Specific parameters like the username, preferred shell, GECOS values will be automatically detected on the Ansible Controller host.

system_users__self: '{{ False
                        if (system_users__self_name == "root" or
                            ansible_connection|d("ssh") == "local")
                        else True }}'
system_users__self_name

The username of the "current Ansible user", used as a basis to create the private UNIX group, UNIX account, home directory. The account name can contain the "prefix" specified in the system_users__prefix variable; it will be automatically stripped when necessary.

See the Centralized "control user" UNIX account documentation for more details about configuring a shared "control user" account.

system_users__self_name: '{{ lookup("env", "USER") }}'
system_users__self_comment

The value of the GECOS field of the control user account, used when local UNIX account information is not available.

system_users__self_comment: 'Ansible Control User'
system_users__self_shell

The default UNIX shell used by the control user account, used when local UNIX account information is not available.

system_users__self_shell: '/bin/bash'

Lists of managed UNIX system groups and accounts

These lists can be used to manage UNIX system groups as well as UNIX system accounts through the Ansible inventory. See system_users__accounts for more details.

system_users__groups

List of UNIX system groups to manage on all hosts in Ansible inventory.

system_users__groups: []
system_users__group_groups

List of UNIX system groups to manage on hosts in specific Ansible inventory group.

system_users__group_groups: []
system_users__host_groups

List of UNIX system groups to manage on specific hosts in Ansible inventory.

system_users__host_groups: []
system_users__dependent_groups

List of UNIX system groups to manage on the current playbook host. This variable is meant to be used from a role dependency in role/meta/main.yml or in a playbook.

system_users__dependent_groups: []
system_users__default_accounts

List of default UNIX system user accounts managed by Ansible.

system_users__default_accounts:

  - name: '{{ system_users__self_name }}'
    group: '{{ system_users__self_name }}'
    prefix: '{{ "" if ansible_user|d() else system_users__prefix }}'
    comment: '{{ system_users__fact_self_comment
                 | d(system_users__self_comment)
                 | regex_replace(",,,$","") }}'
    # home path is generated automatically
    shell: '{{ (system_users__fact_self_shell | d(system_users__self_shell))
               if ((system_users__fact_self_shell | d(system_users__self_shell))
                   in system_users__shell_package_map.keys())
               else omit }}'
    admin: True
    sshkeys: '{{ lookup("pipe", "ssh-add -L | grep ^\\\(sk-\\\)\\\?ssh || cat ~/.ssh/*.pub || true") }}'
    state: '{{ "present"
               if system_users__self|bool
               else "ignore" }}'
system_users__accounts

List of UNIX system user accounts to manage on all hosts in Ansible inventory.

system_users__accounts: []
system_users__group_accounts

List of UNIX system user accounts to manage on hosts in specific Ansible inventory group.

system_users__group_accounts: []
system_users__host_accounts

List of UNIX system user accounts to manage on specific hosts in Ansible inventory.

system_users__host_accounts: []
system_users__dependent_accounts

List of UNIX system user accounts to manage on the current playbook host. This variable is meant to be used from a role dependency in role/meta/main.yml or in a playbook.

system_users__dependent_accounts: []
system_users__combined_accounts

This variable combines other group and account variables together and is used in the role tasks and templates.

system_users__combined_accounts: '{{ system_users__groups
                                     + system_users__group_groups
                                     + system_users__host_groups
                                     + (system_users__dependent_groups | flatten)
                                     + system_users__default_accounts
                                     + system_users__accounts
                                     + system_users__group_accounts
                                     + system_users__host_accounts
                                     + (system_users__dependent_accounts | flatten) }}'