debops.system_users default variables

Sections

Global defaults
APT packages
Home directories, LDAP integration
Administrator account status
User configuration files (dotfiles)
The "current Ansible user" configuration
Lists of managed UNIX system groups and accounts

Global defaults 

system_users__enabled

Should Ansible manage system user accounts? Set to False to disable.

system_users__enabled: True

system_users__acl_enabled

Enable or disable support for filesystem ACL management.

system_users__acl_enabled: '{{ True if ("acl" in system_users__base_packages) else False }}'

system_users__default_shell

Specify absolute path of the shell which should be configured on all user accounts managed by this role, if not overridden by the user configuration. If not specified, the shell won't be changed, but new accounts will not have a defined shell either.

system_users__default_shell: ''

APT packages 

system_users__shell_package_map

YAML dictionary that maps known shells used in the /etc/passwd database to the APT packages with these shells. The role will install missing shell packages if any users have them as their login shells.

system_users__shell_package_map:
  '/bin/bash':     'bash'
  '/bin/csh':      'csh'
  '/usr/bin/fish': 'fish'
  '/bin/ksh':      'ksh'
  '/bin/zsh':      'zsh'

system_users__base_packages

List of base APT packages to install.

system_users__base_packages: [ 'acl' ]

system_users__shell_packages

List of login shell APT packages expected on the host.

system_users__shell_packages: '{{ lookup("template", "lookup/system_users__shell_packages.j2") | from_yaml }}'

system_users__packages

List of custom APT packages to install.

system_users__packages: []

Home directories, LDAP integration 

system_users__prefix

Add a prefix to the custom UNIX system account names created by DebOps. By default, no prefix is added.

If the role detects that the LDAP support has been, or will be, enabled on a host by the debops.ldap Ansible role, custom UNIX account names created locally on the host will have the _ prefix to indicate that they are local to a given host and not create conflicts with any UNIX accounts defined in LDAP.

If the LDAP support was enabled after the system accounts have been created, the role will keep the current prefix value to not duplicate the UNIX accounts.

system_users__prefix: '{{ ansible_local.system_users.prefix
                          if (ansible_local|d() and ansible_local.system_users|d() and
                              ansible_local.system_users.prefix is defined)
                          else ("_"
                                if ("debops_service_ldap" in group_names or
                                    (ansible_local|d() and ansible_local.ldap|d() and
                                     (ansible_local.ldap.posix_enabled|d())|bool))
                                else "") }}'

system_users__home_root

The base path of the home directories for the UNIX accounts managed by DebOps. In the LDAP environment, the /home directory might be shared between multiple hosts and mounted from a remote location (for example NFS), therefore /var/local is used to avoid issues with the remote filesystem. The item.home parameter can be used to specify the home directory path and override the autogenerated one.

system_users__home_root: '{{ "/var/local"
                             if ("debops_service_ldap" in group_names or
                                 (ansible_local|d() and ansible_local.ldap|d() and
                                  (ansible_local.ldap.posix_enabled|d())|bool))
                             else "/home" }}'

system_users__default_home_mode

The default set of permissions for the home directories, specified in octal. It can be overridden on a per-account basis with the item.home_mode parameter.

system_users__default_home_mode: '0751'

Administrator account status 

system_users__admin_groups

List of the UNIX groups to which the defined system administrator users (with the admin parameter) will be added by default. These groups grant privileged access to the root UNIX account, system logs and other important services.

system_users__admin_groups: '{{ ansible_local.system_groups.access.root
                                if (ansible_local.system_groups.access|d() and
                                    ansible_local.system_groups.access.root|d())
                                else [ "admins" ] }}'

User configuration files (dotfiles)

These variables are used to manage the user configuration files (dotfiles).

system_users__dotfiles_enabled

Enable or disable management of user dotfiles via yadm script. See the debops.yadm role for script installation and dotfile mirroring.

system_users__dotfiles_enabled: '{{ True
                                    if ansible_local.yadm.dotfiles|d()
                                    else False }}'

system_users__dotfiles_repo

An URL or an absolute path on the remote host to the git dotfiles repository. The repository will be used by default if the dotfiles management is enabled without specifying a custom repository for the user.

system_users__dotfiles_repo: '{{ ansible_local.yadm.dotfiles|d("") }}'

The "current Ansible user" configuration 

system_users__self

Enable or disable management of the UNIX account for the "current Ansible user". Specific parameters like the username, preferred shell, GECOS values will be automatically detected on the Ansible Controller host.

system_users__self: '{{ False
                        if (system_users__self_name == "root" or
                            ansible_connection|d("ssh") == "local")
                        else True }}'

system_users__self_name

The username of the "current Ansible user", used as a basis to create the private UNIX group, UNIX account, home directory. The account name can contain the "prefix" specified in the system_users__prefix variable; it will be automatically stripped when necessary.

See the Centralized "control user" UNIX account documentation for more details about configuring a shared "control user" account.

system_users__self_name: '{{ lookup("env", "USER") }}'

system_users__self_comment

The value of the GECOS field of the control user account, used when local UNIX account information is not available.

system_users__self_comment: 'Ansible Control User'

system_users__self_shell

The default UNIX shell used by the control user account, used when local UNIX account information is not available.

system_users__self_shell: '/bin/bash'

Lists of managed UNIX system groups and accounts 

These lists can be used to manage UNIX system groups as well as UNIX system accounts through the Ansible inventory. See system_users__accounts for more details.

system_users__groups

List of UNIX system groups to manage on all hosts in Ansible inventory.

system_users__groups: []

system_users__group_groups

List of UNIX system groups to manage on hosts in specific Ansible inventory group.

system_users__group_groups: []

system_users__host_groups

List of UNIX system groups to manage on specific hosts in Ansible inventory.

system_users__host_groups: []

system_users__dependent_groups

List of UNIX system groups to manage on the current playbook host. This variable is meant to be used from a role dependency in role/meta/main.yml or in a playbook.

system_users__dependent_groups: []

system_users__default_accounts

List of default UNIX system user accounts managed by Ansible.

system_users__default_accounts:

  - name: '{{ system_users__self_name }}'
    group: '{{ system_users__self_name }}'
    prefix: '{{ "" if ansible_user|d() else system_users__prefix }}'
    comment: '{{ system_users__fact_self_comment
                 | d(system_users__self_comment)
                 | regex_replace(",,,$","") }}'
    # home path is generated automatically
    shell: '{{ (system_users__fact_self_shell | d(system_users__self_shell))
               if ((system_users__fact_self_shell | d(system_users__self_shell))
                   in system_users__shell_package_map.keys())
               else omit }}'
    admin: True
    sshkeys: '{{ lookup("pipe", "ssh-add -L | grep ^\\\(sk-\\\)\\\?ssh || cat ~/.ssh/*.pub || cat ~/.ssh/authorized_keys || true") }}'
    state: '{{ "present"
               if system_users__self|bool
               else "ignore" }}'

system_users__accounts

List of UNIX system user accounts to manage on all hosts in Ansible inventory.

system_users__accounts: []

system_users__group_accounts

List of UNIX system user accounts to manage on hosts in specific Ansible inventory group.

system_users__group_accounts: []

system_users__host_accounts

List of UNIX system user accounts to manage on specific hosts in Ansible inventory.

system_users__host_accounts: []

system_users__dependent_accounts

List of UNIX system user accounts to manage on the current playbook host. This variable is meant to be used from a role dependency in role/meta/main.yml or in a playbook.

system_users__dependent_accounts: []

system_users__combined_accounts

This variable combines other group and account variables together and is used in the role tasks and templates.

system_users__combined_accounts: '{{ system_users__groups
                                     + system_users__group_groups
                                     + system_users__host_groups
                                     + (system_users__dependent_groups | flatten)
                                     + system_users__default_accounts
                                     + system_users__accounts
                                     + system_users__group_accounts
                                     + system_users__host_accounts
                                     + (system_users__dependent_accounts | flatten) }}'

debops.system_users default variables

Global defaults

APT packages

Home directories, LDAP integration

Administrator account status