rewrite with higher security

README.md

@@ -1,2 +1,13 @@
-# clientmgmt
+# Ansible as installer
 
+## Requirements
+Ansible must be installed ;-) 
+
+### Debian // Ubuntu
+> apt install -y ansible
+
+## RHEL // CentOS // Rocky
+> yum install -y ansible
+
+## Arch
+> pacman -S ansible

client_wg1.conf.j2

@@ -0,0 +1,9 @@
+[Interface]
+PrivateKey = {{ wireguard.client_key}}
+Address = {{ wireguard.client_ip }}
+
+[Peer]
+PublicKey = {{ wireguard.server_pubkey }}
+Endpoint = {{ wireguard.server_address }}:{{ wireguard.server_port }}
+AllowedIPs = {{ wireguard.vpnnet }}
+PersistentKeepalive = 25

installer.yml

@@ -0,0 +1,159 @@
+#!/usr/bin/ansible-playbook --inventory=localhost,
+---
+- hosts: localhost
+  connection: local
+  force_handlers: true
+  vars:
+    ansible_python_interpreter: auto_silent
+  vars_files:
+    - secret_vars.yml
+# check if user == root
+  pre_tasks:
+    - set_fact:
+        eff_uid_number: "{{ lookup('pipe', 'id -u') }}"
+      
+    - block:
+      - debug:
+          msg: "Run as root!"
+      - meta: end_play
+      when: eff_uid_number|int != 0
+
+# run playbook
+  tasks:
+    - name: include distibution vars
+      ansible.builtin.include_vars:
+        file: "vars_{{ ansible_distribution | lower }}.yaml"
+    
+    # prepare ansible user
+    - name: create ansible user
+      user:
+        name: "{{ admin_user_ansible }}"
+        uid: 2001
+        groups: "{{ sudo_group }}"
+        shell: /bin/bash
+        home: /srv/ansible
+        comment: Ansible Service User
+          
+    - name: set ansible user sudo passless
+      copy:
+        dest: "/etc/sudoers.d/adm-ansible"
+        content: "adm-ansible ALL=(ALL) NOPASSWD: ALL"
+        mode: 0600
+        owner: root
+
+    - name: add ansible auth key
+      no_log: true
+      ansible.posix.authorized_key:
+        user: adm-ansible
+        key: "{{ ssh_key_ansible }}"
+
+    - name: enable ssh
+      systemd:
+        name: sshd
+        state: started
+        enabled: yes
+
+    - name: set ssh port
+      lineinfile:
+        dest: /etc/ssh/sshd_config
+        regex: "^[#]?Port"
+        line: "Port {{ ssh_port }}"
+      notify: restart sshd
+
+    - name: disable ansible password login
+      blockinfile:
+        dest: /etc/ssh/sshd_config
+        block: |
+          Match User {{ admin_user_ansible }}
+              PasswordAuthentication no
+      notify: restart sshd
+
+
+    # installs
+    - name: install default packages with package manager
+      ansible.builtin.package:
+        name:
+          - "{{ item }}"
+        state: present
+      loop: "{{ package_installs }}"
+      when: package_installs is defined
+
+    # debian tasks
+    - name: import distribution tasks
+      ignore_errors: yes
+      ansible.builtin.include_tasks:
+        file: "tasks_{{ ansible_distribution }}.yml"
+
+    - name: ensure dirs exist
+      ansible.builtin.file:
+        path: "{{ item.value }}"
+        state: directory
+        mode: '0777'
+      loop: "{{ directorys | dict2items}}" 
+      when: directorys is defined
+
+    - name: get appimage programms
+      ansible.builtin.get_url:
+        url: "{{ item.url }}"
+        dest: "{{ directorys.appimage_dir }}/{{ item.name }}.appimage"
+        mode: '0775'
+      loop: "{{ appimages }}"
+      when: appimages is defined
+
+    - name: get executable programms
+      ansible.builtin.get_url:
+        url: "{{ item.url }}"
+        dest: "/usr/bin/{{ item.name }}"
+        mode: '0775'
+      loop: "{{ executables }}"
+      when: executables is defined
+
+    # wireguard setup
+    - name: check file wg0
+      no_log: true
+      stat:
+        path: /etc/wireguard/wg0.conf
+      register: interface_wg0
+
+    - name: create client wireguard config
+      no_log: true
+      template:
+        dest: /etc/wireguard/wg1.conf
+        src: client_wg1.conf.j2
+        owner: root
+        group: root
+        mode: '0600'
+      when: not interface_wg0.stat.exists
+      notify: restart wg-quick@wg1
+
+    - name: start wireguard and enable on boot
+      no_log: true
+      systemd:
+        name: wg-quick@wg1
+        enabled: yes
+        state: started
+      when: not interface_wg0.stat.exists
+      notify: discord push
+
+  handlers:
+    - name: restart sshd
+      systemd:
+        name: sshd
+        state: restarted
+
+    - name: restart wg-quick@wg1
+      systemd:
+        name: sshd
+        state: restarted
+
+    - name: discord push
+      no_log: true
+      uri:
+        url: "{{ discord_url }}"
+        method: 'POST'
+        body_format: json
+        body: {
+          'content': "i am online",
+          'username': "{{ ansible_hostname }}"
+        }
+        status_code: 204

tasks_debian.yml

@@ -0,0 +1,50 @@
+- block:
+  - name: add gpg keys
+    ansible.builtin.apt_key:
+      url: "{{ item.gpg }}"
+      state: present
+    loop: "{{ nondefault_package_installs }}"
+    when: nondefault_package_installs is defined
+
+  - name: update apt source.list.d
+    ansible.builtin.apt_repository:
+      repo: "{{ item.source }}"
+      state: present
+      filename: programms
+      update_cache: yes
+    loop: "{{ nondefault_package_installs }}"
+    when: nondefault_package_installs is defined
+
+  - name: install non-default packages with package manager
+    ansible.builtin.package:
+      name:
+        - "{{ item.name }}"
+      state: present
+    loop: "{{ nondefault_package_installs }}"
+    when: nondefault_package_installs is defined
+
+  - name: download deb files
+    ansible.builtin.get_url:
+      url: "{{ item.url }}"
+      dest: "/tmp/{{ item.name }}.deb"
+      mode: "0440"
+    loop: "{{ deb_installs }}"
+    when: deb_installs is defined
+
+  - name: install deb files
+    ansible.builtin.apt:
+      deb: "/tmp/{{ item.name }}.deb"
+    loop: "{{ deb_installs }}"
+    when: deb_installs is defined
+
+  - name: update all packages
+    apt:
+      name: '*'
+      state: latest
+      update_cache: yes
+
+  - name: clean apt cache
+    apt:
+      autoclean: yes
+
+  when: ansible_os_family == "Debian"

vars_archlinux.yml

@@ -0,0 +1,5 @@
+sudo_group: wheel
+package_installs:
+  - curl
+  - vim
+  - wireguard-tools

vars_debian.yml

@@ -0,0 +1,5 @@
+sudo_group: sudo
+package_installs:
+  - vim
+  - curl
+  - wireguard

vars_secrets.yml

@@ -0,0 +1,64 @@
+$ANSIBLE_VAULT;1.1;AES256
+31646238623838666665656266656634383962303336616663323664626338393139616439303661
+3061313932663361346561306632653735623338633034650a343263663937313366303065333861
+63306537326131346431343635373630396662613131346666633065653735626661626537666433
+3837313461333430340a323665336330366237323264393733663762316361363437386134626336
+63373839386338313739373630343065356163613732303536346133633666316438623866363539
+31313131636434633063383532373064303536653734663530633065336562666339383233616661
+36376336653738626266643033346666633834396436336232623561313763636535336161663639
+62623966333365623066646136623130333339383633396461323661663536303937663936333830
+38336265353765376266383939356664303137636639386266336639623965653765373966306666
+34643634663964363765366133353062326431333764653761343531306537653564386335656335
+62363733303266396161623363376566306366653166356630656262623132393337373832313130
+63663163346662613862613435633132383830306430613265373234626430646336666137303534
+39623834666535366166346432376337303135386134353131326566343562353066323436323263
+34343934333636653436323930333533653139303061633063383335356531336166663063626237
+64633965373239386366303234353663633664666439306130656666343935386231663035323135
+35663261343065363738313931323163313434373032626132643936656164343931313538323364
+31626131643235653235623838613663333636623937356434343162386136343731646665623532
+63626130303065313031613761323039663061333466666366656136316337626464666665636662
+34393833613165623663343133313834313433623530333561303064656262613231306430396431
+31666538616332363130666361306339373065323936333565643634303436343232333834653261
+36656639363532343530646237393236356665643739303263326634616236363030656533383138
+31636165396132346366663965326335343634356461626661366631306161316135613232663562
+62616433623564643130656532656365646661313762633136633838386135616565663266313562
+36323238343637353164646562313634376631306535323730313335633533313536393962386664
+65343235373838313338613135333265653236643438643530323963353261356661666566396230
+34376630616631383930333263643036666237313036633739356431373762623430623831396634
+62373632646638343033393534633231303332303764616633633433393034323836383634653136
+32666432383933393432393535653330393137613437333136326466353837666633383934656133
+33373734346664336231316232636230613639616361343761333935613030396239313862303538
+36356165663666623764633330313439393565396634346237656361643039356565313331623461
+33656533313436336530643030376136633933316634363131363637626566633839633264313138
+30383262616166363061376237373765363931393737663733643066613464346535383862376531
+65306230393431333265623030353861653363353661366265663163643033333231643165353666
+35646466343032626261323131376464386266373264623330333864323561326234366639623431
+39656664373135313939313066633964323532623266316333363961323634336237316135626164
+33313063303166303830623338353366626338653637343431613039333562306164393939643031
+35633434643263313039363935356665643730613936653738613932356533336336663439383739
+64346562323962666239626364666635666363313232613738333638646666643437343264306232
+31666638303735383433303032626133383332386263636362366330356538303466643832306635
+34313239383466326135666366356461346464323334373763313362363238383935633062366636
+61386331306239346264346338326132336464393965633932643436376339613238303666626339
+32353237633761343734376465396535346263303630386461633736303364336238373536333764
+65663632393036353731323163616338343838303366303362623531363636383236386535616462
+30386330333530633536396537623062653865353830653431376433323934393638363338376536
+62356538633236373635303631353435366136323139386238653039636566346364626166316366
+62396635383166336235333963616563343366656434313230373330376533353866366236646131
+64386363373232613266626435393362333134633738653132656461306339333066623962343537
+31373764346263313466353037316264646662663437356562326535616365383366616662333739
+35626163336332353730373839373066633738633861343335623964353638316364346365393166
+37386566333764373637336361666666333131303034383561663337313461306137316364313666
+39336238373631366636326434333236303766373437383638656637616362393830366438643133
+63613434343033313534383832616465613063633761613965633136333961383333356363343538
+33303430643732613231643730393930333132656662333931366666376138666365313631643261
+32666634323962316562646630313733353466393366623631333962386163356439346563343833
+37613133313163653136316237636434633035633239316332643433343533343534313739633537
+39353462636264383336323830336334613237306537626632613366653161383864613337623933
+61333132343666616438613635643663383138373364303536653736323962633461633332333162
+35663563666664626332303331353138336131313764396436623734346563646363386633373263
+33366566306364623962326534653739316233326163366237643264666365616466393631336638
+36313539623236643364643037383638626239313132646430393161306336393531343536336538
+32623336333766323534663639663334376338343666636537353264666539666638343961353832
+33333666353635396463353739313065323964623437343435623761643131343733366130613337
+396237303039396537306435643530376664