mirror of
https://pagure.io/fedora-infra/ansible.git
synced 2026-05-05 10:10:08 +08:00
86 lines
1.9 KiB
YAML
86 lines
1.9 KiB
YAML
---
|
|
- name: Install IPA client packages
|
|
package:
|
|
name:
|
|
- freeipa-client
|
|
state: present
|
|
tags:
|
|
- ipa/client
|
|
- packages
|
|
|
|
- name: Enable VPN hosts to talk to IPA
|
|
import_tasks: vpn.yml
|
|
tags:
|
|
- ipa/client
|
|
- vpn-client-enablement
|
|
|
|
- name: Enroll system as IPA client
|
|
command:
|
|
cmd: ipa-client-install
|
|
{% if (vpn | default(false)) %}{% for node in ipa_server_nodes | default([]) %}
|
|
--server={{ node }}
|
|
{% endfor %}{% endif %}
|
|
--hostname={{ inventory_hostname }}
|
|
--domain={{ ipa_realm | lower }}
|
|
--realm={{ ipa_realm }}
|
|
-p admin -w {{ ipa_admin_password }}
|
|
-U -N --force-join
|
|
--mkhomedir
|
|
--no-ssh
|
|
creates: /etc/ipa/default.conf
|
|
notify: clean sss caches
|
|
tags:
|
|
- ipa/client
|
|
- config
|
|
|
|
- name: Remove ipa sshd config since we do not need it
|
|
file:
|
|
state: absent
|
|
path: /etc/ssh/sshd_config.d/04-ipa.conf
|
|
tags:
|
|
- ipa/client
|
|
- config
|
|
|
|
- name: Prepare IPA-related information to make the following more efficient
|
|
delegate_to: localhost
|
|
import_tasks: prepare-ipa-info.yml
|
|
tags:
|
|
- ipa/client
|
|
- config
|
|
run_once: yes
|
|
|
|
- name: Basic configuration for clients on IPA cluster
|
|
delegate_to: localhost
|
|
import_tasks: common.yml
|
|
tags:
|
|
- ipa/client
|
|
- config
|
|
run_once: yes
|
|
|
|
- name: Configure HBAC on IPA cluster
|
|
delegate_to: "{{ ipa_server }}"
|
|
import_tasks: hbac.yml
|
|
tags:
|
|
- ipa/client
|
|
- config
|
|
run_once: yes
|
|
|
|
- name: Configure sudo on IPA cluster
|
|
#delegate_to: "{{ ipa_server }}"
|
|
import_tasks: sudo.yml
|
|
tags:
|
|
- ipa/client
|
|
- config
|
|
run_once: yes
|
|
|
|
- name: Ensure that nss knows to skip certain users
|
|
template: src=fedora-nss-ignore.conf.j2 dest=/etc/sssd/conf.d/fedora-nss-ignore.conf mode=600 owner=root group=root
|
|
tags:
|
|
- ipa/client
|
|
- config
|
|
notify:
|
|
- restart sssd
|
|
- clean sss caches
|
|
|
|
- meta: flush_handlers
|