Ansible for Linux System Administration: crontab, mounts, users, sudoers

- name: Create application user
  ansible.builtin.user:
    name: deploy
    comment: "Deployment user"
    groups:
      - wheel
      - docker
    shell: /bin/bash
    create_home: true
    home: /home/deploy
    state: present

- name: Create team accounts
  ansible.builtin.user:
    name: "{{ item.name }}"
    groups: "{{ item.groups | default(omit) }}"
    shell: "{{ item.shell | default('/bin/bash') }}"
    state: present
  loop:
    - { name: alice, groups: ['developers', 'docker'] }
    - { name: bob, groups: ['developers'] }
    - { name: charlie, groups: ['developers', 'wheel'] }

- name: Deploy SSH keys for team
  ansible.posix.authorized_key:
    user: "{{ item.name }}"
    key: "{{ item.key }}"
    state: present
    exclusive: false
  loop:
    - { name: alice, key: "ssh-ed25519 AAAA... alice@company" }
    - { name: bob, key: "ssh-ed25519 AAAA... bob@company" }
    - { name: charlie, key: "ssh-ed25519 AAAA... charlie@company" }

- name: Remove former employee
  ansible.builtin.user:
    name: ex_employee
    state: absent
    remove: true    # Also removes home directory
    force: true     # Remove even if user is logged in

- name: Set user password
  ansible.builtin.user:
    name: deploy
    password: "{{ 'SecurePassword123!' | password_hash('sha512', 'salt') }}"
    update_password: on_create    # Only set on creation, not every run
  no_log: true

- name: Create application groups
  ansible.builtin.group:
    name: "{{ item }}"
    state: present
  loop:
    - developers
    - operations
    - dbadmins

- name: Add user to supplementary groups
  ansible.builtin.user:
    name: deploy
    groups:
      - developers
      - docker
    append: true    # Don't remove existing groups

- name: Schedule daily backup at 2 AM
  ansible.builtin.cron:
    name: "daily database backup"
    minute: "0"
    hour: "2"
    job: "/opt/scripts/backup-db.sh >> /var/log/backup.log 2>&1"
    user: postgres

- name: Run at reboot
  ansible.builtin.cron:
    name: "start application on boot"
    special_time: reboot
    job: "/opt/app/bin/start.sh"
    user: deploy

# Other special_time values: hourly, daily, weekly, monthly, annually

- name: Set cron PATH
  ansible.builtin.cron:
    name: PATH
    env: true
    job: "/usr/local/bin:/usr/bin:/bin"
    user: deploy

- name: Set cron MAILTO
  ansible.builtin.cron:
    name: MAILTO
    env: true
    job: "admin@example.com"
    user: deploy

- name: Remove old backup job
  ansible.builtin.cron:
    name: "old backup script"
    state: absent
    user: postgres

- name: Configure all cron jobs
  ansible.builtin.cron:
    name: "{{ item.name }}"
    minute: "{{ item.minute | default('*') }}"
    hour: "{{ item.hour | default('*') }}"
    day: "{{ item.day | default('*') }}"
    month: "{{ item.month | default('*') }}"
    weekday: "{{ item.weekday | default('*') }}"
    job: "{{ item.job }}"
    user: "{{ item.user | default('root') }}"
    state: present
  loop:
    - { name: "DB backup", hour: "2", minute: "0", job: "/opt/scripts/backup.sh", user: postgres }
    - { name: "Log rotation", hour: "3", minute: "30", job: "/usr/sbin/logrotate /etc/logrotate.conf" }
    - { name: "SSL renewal", hour: "4", minute: "0", weekday: "1", job: "certbot renew --quiet" }
    - { name: "Disk cleanup", hour: "5", minute: "0", day: "1", job: "/opt/scripts/cleanup.sh" }

- name: Install NFS client
  ansible.builtin.apt:
    name: nfs-common
    state: present

- name: Mount NFS share
  ansible.posix.mount:
    src: "nfs-server:/exports/data"
    path: /mnt/data
    fstype: nfs
    opts: "rw,sync,hard,intr"
    state: mounted    # Mounts AND adds to fstab

# state: mounted — mount now AND add to fstab
# state: present — add to fstab only (don't mount now)
# state: unmounted — unmount but keep in fstab
# state: absent — unmount AND remove from fstab
# state: remounted — remount (apply new options)

- name: Create filesystem
  community.general.filesystem:
    fstype: ext4
    dev: /dev/sdb1

- name: Mount data volume
  ansible.posix.mount:
    src: /dev/sdb1
    path: /data
    fstype: ext4
    opts: "defaults,noatime"
    state: mounted

- name: Set ownership
  ansible.builtin.file:
    path: /data
    owner: deploy
    group: deploy
    mode: '0755'

- name: Mount tmpfs for application cache
  ansible.posix.mount:
    src: tmpfs
    path: /opt/app/cache
    fstype: tmpfs
    opts: "size=512M,mode=0755,uid=deploy,gid=deploy"
    state: mounted

# ALWAYS use /etc/sudoers.d/ — never edit /etc/sudoers directly
- name: Grant deploy user sudo for service management
  ansible.builtin.copy:
    content: |
      # Managed by Ansible
      deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp, /usr/bin/systemctl status myapp
    dest: /etc/sudoers.d/deploy
    mode: '0440'
    owner: root
    group: root
    validate: 'visudo -cf %s'    # Validate before writing!

- name: Grant wheel group full sudo
  ansible.builtin.copy:
    content: |
      # Managed by Ansible
      %wheel ALL=(ALL) NOPASSWD: ALL
    dest: /etc/sudoers.d/wheel
    mode: '0440'
    validate: 'visudo -cf %s'

- name: Grant developers limited sudo
  ansible.builtin.copy:
    content: |
      # Managed by Ansible
      %developers ALL=(deploy) NOPASSWD: /opt/app/bin/deploy.sh
      %developers ALL=(root) NOPASSWD: /usr/bin/journalctl -u myapp*
    dest: /etc/sudoers.d/developers
    mode: '0440'
    validate: 'visudo -cf %s'

- name: Remove old sudoers rule
  ansible.builtin.file:
    path: /etc/sudoers.d/old_rule
    state: absent

---
- name: Configure Linux server
  hosts: all
  become: true
  vars:
    admin_users:
      - { name: alice, key: "ssh-ed25519 AAAA... alice" }
      - { name: bob, key: "ssh-ed25519 AAAA... bob" }
    app_user: deploy
    data_mount: /data

  tasks:
    # Users
    - name: Create admin users
      ansible.builtin.user:
        name: "{{ item.name }}"
        groups: [wheel]
        shell: /bin/bash
      loop: "{{ admin_users }}"

    - name: Deploy SSH keys
      ansible.posix.authorized_key:
        user: "{{ item.name }}"
        key: "{{ item.key }}"
      loop: "{{ admin_users }}"

    - name: Create application user
      ansible.builtin.user:
        name: "{{ app_user }}"
        system: true
        shell: /bin/bash

    # Sudo
    - name: Configure sudoers
      ansible.builtin.copy:
        content: "{{ app_user }} ALL=(root) NOPASSWD: /usr/bin/systemctl * myapp\n"
        dest: "/etc/sudoers.d/{{ app_user }}"
        mode: '0440'
        validate: 'visudo -cf %s'

    # Cron
    - name: Schedule backups
      ansible.builtin.cron:
        name: "daily backup"
        hour: "2"
        minute: "0"
        job: "/opt/scripts/backup.sh"
        user: "{{ app_user }}"

    # Mounts
    - name: Mount data volume
      ansible.posix.mount:
        src: /dev/sdb1
        path: "{{ data_mount }}"
        fstype: ext4
        state: mounted
      when: ansible_devices.sdb is defined