0.2.1 revision

roles/matrix-awx/tasks/create_user.yml

@@ -20,7 +20,7 @@
 
 - name: Create user account
   command: |
-    /usr/local/bin/matrix-synapse-register-user {{ new_username }} '{{ new_password }}' {{ admin_bool }}
+    /usr/local/bin/matrix-synapse-register-user {{ new_username | quote }} {{ new_password | quote }} {{ admin_bool }}
   register: cmd
 
 - name: Result

roles/matrix-awx/tasks/customise_website_access_export.yml

@@ -21,17 +21,20 @@
   with_dict:
     'matrix_nginx_proxy_base_domain_homepage_enabled': 'false'
   when: customise_base_domain_website|bool == true
-
-- name: Record 'Customise Website + Access Backup' variables locally on AWX
+    
+- name: Record custom 'Customise Website + Access Export' variables locally on AWX
   delegate_to: 127.0.0.1
   lineinfile:
     path: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
     regexp: "^#? *{{ item.key | regex_escape() }}:"
     line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# AWX Settings'
+    insertafter: '# Custom Settings'
   with_dict:
     'customise_base_domain_website': '{{ customise_base_domain_website }}'
-
+    'sftp_auth_method': '"{{ sftp_auth_method }}"'
+    'sftp_password': '"{{ sftp_password }}"'
+    'sftp_public_key': '"{{ sftp_public_key }}"'
+    
 - name: Copy new 'matrix_vars.yml' to target machine
   copy:
     src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
@@ -41,17 +44,18 @@
 - name: Reload vars in matrix_vars.yml
   include_vars:
     file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
+  no_log: True
 
-- name: Save new 'Customise Website + Access Backup' survey.json to the AWX tower, template
+- name: Save new 'Customise Website + Access Export' survey.json to the AWX tower, template
   delegate_to: 127.0.0.1
   template:
-    src: './roles/matrix-awx/surveys/configure_website_access_backup.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_backup.json'
+    src: './roles/matrix-awx/surveys/configure_website_access_export.json.j2'
+    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_export.json'
 
-- name: Copy new 'Customise Website + Access Backup' survey.json to target machine
+- name: Copy new 'Customise Website + Access Export' survey.json to target machine
   copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_backup.json'
-    dest:  '/matrix/awx/configure_website_access_backup.json'
+    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_export.json'
+    dest:  '/matrix/awx/configure_website_access_export.json'
     mode: '0660'
 
 - name: Collect AWX admin token the hard way!
@@ -61,11 +65,11 @@
   register: tower_token
   no_log: True
 
-- name: Recreate 'Customise Base Domain Website' job template
+- name: Recreate 'Customise Base Domain Export' job template
   delegate_to: 127.0.0.1
   awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Website + Access Backup"
-    description: "Configure base domain website settings and access the services backup."
+    name: "{{ matrix_domain }} - 1 - Configure Website + Access Export"
+    description: "Configure base domain website settings and access the servers export."
     extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
     job_type: run
     job_tags: "start,setup-nginx-proxy"
@@ -74,7 +78,7 @@
     playbook: setup.yml
     credential: "{{ member_id }} - AWX SSH Key"
     survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_backup.json') }}"
+    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_export.json') }}"
     become_enabled: yes
     state: present
     verbosity: 1
@@ -82,40 +86,32 @@
     tower_oauthtoken: "{{ tower_token.stdout }}"
     validate_certs: yes
 
-# Copied over from provision stage
-
-- name: Copy ssh_sftp.service file
-  copy:
-    src: './roles/matrix-awx/templates/sftp/ssh_sftp.service'
-    dest: '/lib/systemd/system/ssh_sftp.service'
-    mode: 0644
-
-- name: Copy sshd config file
-  copy:
-    src: './roles/matrix-awx/templates/sftp/sshd_sftp_config'
-    dest: '/etc/ssh/sshd_sftp_config'
-    mode: 0644
-
 - name: Ensure group "sftp" exists
   group:
     name: sftp
     state: present
 
-- name: If user defines sftp_password, enable account / set password on 'stfp' account.
+- name: If user doesn't define a sftp_password, create a disabled 'sftp' account
   user:
     name: sftp
-    comment: SFTP user to set custom web files
+    comment: SFTP user to set custom web files and access servers export
     shell: /bin/false
-    home: /home/sftp/
+    home: /home/sftp
+    group: sftp
+    password: '*'
+    update_password: always
+  when: sftp_password|length == 0
+
+- name: If user defines sftp_password, enable account and set password on 'stfp' account
+  user:
+    name: sftp
+    comment: SFTP user to set custom web files and access servers export
+    shell: /bin/false
+    home: /home/sftp
     group: sftp
     password: "{{ sftp_password | password_hash('sha512') }}"
     update_password: always
-  when: (sftp_password is defined) and (sftp_password|length > 0)
-
-# would be safer if it generated the password for you!
-
-- name: Setup SFTP users default root path
-  shell: sudo usermod -d / sftp
+  when: sftp_password|length > 0
 
 - name: adding existing user 'sftp' to group matrix
   user:
@@ -131,7 +127,7 @@
     group: root
     mode: '1755'
 
-- name: Create the rw /chroot/website directory if it doesn't exist.
+- name: Ensure /chroot/website location exists.
   file:
     path: /chroot/website
     state: directory
@@ -139,21 +135,96 @@
     group: matrix
     mode: '0574'
 
-- name: Ensure /chroot/backup/ location exists
+- name: Ensure /chroot/export location exists
   file:
-    path: /chroot/backup
+    path: /chroot/export
     state: directory
     owner: sftp
     group: sftp
     mode: '0700'
 
-- name: Enable service ssh_sftp.service
-  service:
-    name: ssh_sftp.service
-    enabled: yes
+- name: Ensure /home/sftp/.ssh location exists
+  file:
+    path: /home/sftp/.ssh
+    state: directory
+    owner: sftp
+    group: sftp
+    mode: '0700'
 
-- name: Start service ssh_sftp.service
-  service:
-    name: ssh_sftp.service
-    state: started
+- name: Ensure /home/sftp/authorized_keys exists
+  file:
+    path: /home/sftp/.ssh/authorized_keys
+    state: touch
+    owner: sftp
+    group: sftp
+    mode: '0644'
+
+- name: Clear authorized_keys file
+  shell: echo "" > /home/sftp/.ssh/authorized_keys
+
+- name: Insert public SSH key into authorized_keys file
+  lineinfile:
+    path: /home/sftp/.ssh/authorized_keys
+    line: "{{ sftp_public_key }}"
+    owner: sftp
+    group: sftp
+    mode: '0644'
+  when: (sftp_public_key | length > 0) and (sftp_auth_method == "SSH Key")
+  
+- name: Alter SSH Subsystem State 1
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    line: "Subsystem sftp	/usr/lib/openssh/sftp-server"
+    state: absent
+
+- name: Alter SSH Subsystem State 2
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    insertafter: "^# override default of no subsystems"
+    line: "Subsystem sftp internal-sftp"
+
+- name: Add SSH Match User section for disabled auth
+  blockinfile:
+    path: /etc/ssh/sshd_config
+    state: absent
+    block: |
+      Match User sftp
+          ChrootDirectory /chroot
+          PermitTunnel no
+          X11Forwarding no
+          AllowTcpForwarding no
+          PasswordAuthentication yes
+          AuthorizedKeysFile /home/sftp/.ssh/authorized_keys
+  when: sftp_auth_method == "Disabled"
+
+- name: Add SSH Match User section for password auth
+  blockinfile:
+    path: /etc/ssh/sshd_config
+    state: present
+    block: |
+      Match User sftp
+          ChrootDirectory /chroot
+          PermitTunnel no
+          X11Forwarding no
+          AllowTcpForwarding no
+          PasswordAuthentication yes
+  when: sftp_auth_method == "Password"
+
+- name: Add SSH Match User section for publickey auth
+  blockinfile:
+    path: /etc/ssh/sshd_config
+    state: present
+    block: |
+      Match User sftp
+          ChrootDirectory /chroot
+          PermitTunnel no
+          X11Forwarding no
+          AllowTcpForwarding no
+          AuthorizedKeysFile /home/sftp/.ssh/authorized_keys
+  when: sftp_auth_method == "SSH Key"
+
+- name: Restart service ssh.service
+  service:
+    name: ssh.service
+    state: restarted
 

roles/matrix-awx/tasks/load_matrix_variables.yml

@@ -2,5 +2,5 @@
 - name: Include vars in matrix_vars.yml
   include_vars:
     file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-#  no_log: True
+  no_log: True
 

roles/matrix-awx/tasks/main.yml

@@ -23,8 +23,8 @@
   tags:
     - import-awx
 
-# Configure SFTP so user can upload a static website
-- import_tasks: "{{ role_path }}/tasks/customise_website_access_backup.yml"
+# Configure SFTP so user can upload a static website or access the servers export
+- import_tasks: "{{ role_path }}/tasks/customise_website_access_export.yml"
   when: run_setup|bool and matrix_awx_enabled|bool
   tags:
     - setup-nginx-proxy