provision.yaml

---
- hosts: all
  become: yes
  vars:
    user: m
  tasks:
     - name: Update and upgrade apt packages
       become: yes
       ignore_errors: yes
       failed_when: "'FAILED' in command_result.stderr"
       apt:
         upgrade: yes
         update_cache: yes
         cache_valid_time: 86400 #One day

     - name: Make sure we have a 'wheel' group
       group:
         name: wheel
         state: present

     - name: Allow 'wheel' group to have passwordless sudo
       lineinfile:
         dest: /etc/sudoers
         state: present
         regexp: '^%wheel'
         line: '%wheel ALL=(ALL) NOPASSWD: ALL'
         validate: 'visudo -cf %s'

     - name: Add sudoers users to wheel group
       user:
         name: "{{ user }}"
         groups: wheel
         append: yes
         state: present
         createhome: yes
         shell: /bin/bash

     - name: Create necessary folders
       file: 
         path: "{{ item }}"
         recurse: yes
         state: directory
       with_items:
         - "/home/{{ user }}/.ssh/"

     - name: Copy secured SSHD configuration
       copy: src=sshd_config_secured dest=/etc/ssh/sshd_config owner=root group=root mode=0644
       #sudo: yes
       
     - name: Copy root bashrc
       copy: src=bashrc dest=/root/.bashrc owner=root group=root mode=0400
       #sudo: yes

     - name: Disable IPv6
       sysctl: 
         name: "{{ item }}" 
         value: '1'
         sysctl_set: yes 
         state: present
       with_items:
         - net.ipv6.conf.all.disable_ipv6
         - net.ipv6.conf.default.disable_ipv6
         - net.ipv6.conf.lo.disable_ipv6

     - name: SSHD restart
       service: name=sshd state=restarted enabled=yes

     - name: Copy keys and profiles
       copy:
         src: "{{ item.src }}"
         dest: "{{ item.dest }}"
         owner: "{{ user }}"
         group: "{{ user }}"
         mode: 0400
       with_items:
         - { src: 'authorized_keys', dest: "/home/{{ user }}/.ssh/authorized_keys" }
         - { src: 'bashrc', dest: "/home/{{ user }}/.bashrc" }