ExternalMirrors
/
users-formula
mirror of https://github.com/saltstack-formulas/users-formula
Watch 1
Star 0
Fork 1
Code Issues 0 Releases 13 Wiki Activity
Saltstack Official Users Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
435 Commits
3 Branches
Tree: 987a451599
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '987a451599'
${ noResults }
users-formula/users/init.sls

625 lines
18KB
Raw Blame History 

  1. # vim: sts=2 ts=2 sw=2 et ai

  2. {% from "users/map.jinja" import users with context %}

  3. {% set used_sudo = [] %}

  4. {% set used_googleauth = [] %}

  5. {% set used_user_files = [] %}

  6. {% set used_polkit = [] %}

  7. {%- set create_dirs = [] %}

  8. {%- set created_groups = [] %}

  9. 

  10. {% for group, setting in salt['pillar.get']('groups', {}).items() %}

  11. {%   if setting.absent is defined and setting.absent or setting.get('state', "present") == 'absent' %}

  12. users_group_absent_{{ group }}:

  13.   group.absent:

  14.     - name: {{ group }}

  15. {% else %}

  16. {%- do created_groups.append(group) %}

  17. users_group_present_{{ group }}:

  18.   group.present:

  19.     - name: {{ group }}

  20.     - gid: {{ setting.get('gid', "null") }}

  21.     - system: {{ setting.get('system',"False") }}

  22.     - members: {{ setting.get('members')|json }}

  23.     - addusers: {{ setting.get('addusers')|json }}

  24.     - delusers: {{ setting.get('delusers')|json }}

  25. {% endif %}

  26. {% endfor %}

  27. 

  28. {%- for name, user in pillar.get('users', {}).items()

  29.         if user.absent is not defined or not user.absent %}

  30. {%- if user == None -%}

  31. {%- set user = {} -%}

  32. {%- endif -%}

  33. {%- if 'sudoonly' in user and user['sudoonly'] %}

  34. {%- set _dummy=user.update({'sudouser': True}) %}

  35. {%- endif %}

  36. {%- if 'sudouser' in user and user['sudouser'] %}

  37. {%- do used_sudo.append(1) %}

  38. {%- endif %}

  39. {%- if 'google_auth' in user %}

  40. {%- do used_googleauth.append(1) %}

  41. {%- endif %}

  42. {%- if salt['pillar.get']('users:' ~ name ~ ':user_files:enabled', False) %}

  43. {%- do used_user_files.append(1) %}

  44. {%- endif %}

  45. {%- if user.get('polkitadmin', False) == True %}

  46. {%- do used_polkit.append(1)  %}

  47. {%- endif %}

  48. {%- endfor %}

  49. 

  50. {%- if used_sudo or used_googleauth or used_user_files or used_polkit %}

  51. include:

  52. {%- if used_sudo %}

  53.   - users.sudo

  54. {%- endif %}

  55. {%- if used_googleauth %}

  56.   - users.googleauth

  57. {%- endif %}

  58. {%- if used_user_files %}

  59.   - users.user_files

  60. {%- endif %}

  61. {%- if used_polkit %}

  62.   - users.polkit

  63. {%- endif %}

  64. {%- endif %}

  65. 

  66. {% for name, user in pillar.get('users', {}).items()

  67.         if user.absent is not defined or not user.absent %}

  68. {%- if user == None -%}

  69. {%- set user = {} -%}

  70. {%- endif -%}

  71. {%- set current = salt.user.info(name) -%}

  72. {%- set home = user.get('home', current.get('home', "/home/%s" % name)) -%}

  73. {%- set createhome = user.get('createhome', users.get('createhome')) -%}

  74. 

  75. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}

  76. {%- set user_group = user.prime_group.name -%}

  77. {%- else -%}

  78. {%- set user_group = name -%}

  79. {%- endif %}

  80. 

  81. {%- if createhome %}

  82. {%- set required_dir = salt['file.dirname'](home) %}

  83. {%- do create_dirs.append(required_dir) %}

  84. {%- endif %}

  85. 

  86. {%- if not ( 'sudoonly' in user and user['sudoonly'] ) %}

  87. 

  88. {#- create prime group #}

  89. {%- if user_group not in created_groups %}

  90. {%- do created_groups.append(user_group) %}

  91. users_group_present_{{ user_group }}:

  92.   group.present:

  93.     - name: {{ user_group }}

  94.     {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}

  95.     - gid: {{ user['prime_group']['gid'] }}

  96.     {%- elif 'uid' in user %}

  97.     - gid: {{ user['uid'] }}

  98.     {%- endif %}

  99.     {% if 'system' in user and user['system'] %}

  100.     - system: True

  101.     {% endif %}

  102. {%- endif %}

  103. 

  104. {#- create required groups #}

  105. {%- for group in user.get('groups', []) if group not in created_groups %}

  106. {%- do created_groups.append(group) %}

  107. users_group_present_{{ group }}:

  108.   group.present:

  109.     - name: {{ group }}

  110.     {% if group == 'sudo' %}

  111.     - system: True

  112.     {% endif %}

  113. {% endfor %}

  114. 

  115. users_{{ name }}_user:

  116.   {% if createhome -%}

  117.   file.directory:

  118.     - name: {{ home }}

  119.     - user: {{ user.get('homedir_owner', name) }}

  120.     - group: {{ user.get('homedir_group', user_group) }}

  121.     - mode: {{ user.get('user_dir_mode', '0750') }}

  122.     - makedirs: True

  123.     - require:

  124.       - user: users_{{ name }}_user

  125.       - group: {{ user_group }}

  126.   {%- endif %}

  127.   user.present:

  128.     - name: {{ name }}

  129.     - home: {{ home }}

  130.     - shell: {{ user.get('shell', current.get('shell', users.get('shell', '/bin/bash'))) }}

  131.     {% if 'uid' in user -%}

  132.     - uid: {{ user['uid'] }}

  133.     {% endif -%}

  134.     {% if 'password' in user -%}

  135.     - password: '{{ user['password'] }}'

  136.     {% endif -%}

  137.     {% if user.get('empty_password') -%}

  138.     - empty_password: {{ user.get('empty_password') }}

  139.     {% endif -%}

  140.     {% if 'enforce_password' in user -%}

  141.     - enforce_password: {{ user['enforce_password'] }}

  142.     {% endif -%}

  143.     {% if 'hash_password' in user -%}

  144.     - hash_password: {{ user['hash_password'] }}

  145.     {% endif -%}

  146.     {% if user.get('system', False) -%}

  147.     - system: True

  148.     {% endif -%}

  149.     {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}

  150.     - gid: {{ user['prime_group']['gid'] }}

  151.     {% elif 'prime_group' in user and 'name' in user['prime_group'] %}

  152.     - gid: {{ user['prime_group']['name'] }}

  153.     {% elif grains.os != 'MacOS' -%}

  154.     - gid: {{ name }}

  155.     {% endif -%}

  156.     {% if 'fullname' in user %}

  157.     - fullname: {{ user['fullname'] }}

  158.     {% endif -%}

  159.     {% if 'roomnumber' in user %}

  160.     - roomnumber: {{ user['roomnumber'] }}

  161.     {% endif %}

  162.     {% if 'workphone' in user %}

  163.     - workphone: {{ user['workphone'] }}

  164.     {% endif %}

  165.     {% if 'homephone' in user %}

  166.     - homephone: {{ user['homephone'] }}

  167.     {% endif %}

  168.     - createhome: {{ createhome }}

  169.     {% if not user.get('unique', True) %}

  170.     - unique: False

  171.     {% endif %}

  172.     {%- if grains['saltversioninfo'] >= [2018, 3, 1] %}

  173.     - allow_gid_change: {{ users.allow_gid_change if 'allow_gid_change' not in user else user['allow_gid_change'] }}

  174.     {%- endif %}

  175.     {% if 'expire' in user -%}

  176.         {% if grains['kernel'].endswith('BSD') and

  177.             user['expire'] < 157766400 %}

  178.         {# 157762800s since epoch equals 01 Jan 1975 00:00:00 UTC #}

  179.     - expire: {{ user['expire'] * 86400 }}

  180.         {% elif grains['kernel'] == 'Linux' and

  181.             user['expire'] > 84006 %}

  182.         {# 2932896 days since epoch equals 9999-12-31 #}

  183.     - expire: {{ (user['expire'] / 86400) | int }}

  184.         {% else %}

  185.     - expire: {{ user['expire'] }}

  186.         {% endif %}

  187.     {% endif -%}

  188.     {% if 'mindays' in user %}

  189.     - mindays: {{ user.get('mindays', None) }}

  190.     {% endif %}

  191.     {% if 'maxdays' in user %}

  192.     - maxdays: {{ user.get('maxdays', None) }}

  193.     {% endif %}

  194.     {% if 'inactdays' in user %}

  195.     - inactdays: {{ user.get('inactdays', None) }}

  196.     {% endif %}

  197.     {% if 'warndays' in user %}

  198.     - warndays: {{ user.get('warndays', None) }}

  199.     {% endif %}

  200.     - remove_groups: {{ user.get('remove_groups', 'False') }}

  201.     - groups:

  202.       - {{ user_group }}

  203.       {% for group in user.get('groups', []) -%}

  204.       - {{ group }}

  205.       {% endfor %}

  206.     {% if 'optional_groups' in user %}

  207.     - optional_groups:

  208.       {% for optional_group in user['optional_groups'] -%}

  209.       - {{ optional_group }}

  210.       {% endfor %}

  211.     {% endif %}

  212.     - require:

  213.       - group: {{ user_group }}

  214.       {% for group in user.get('groups', []) -%}

  215.       - group: {{ group }}

  216.       {% endfor %}

  217.       {%- if createhome and required_dir != '/' %}

  218.       - file: users_prereq_dir_{{ required_dir }}

  219.       {%- endif %}

  220. 

  221. 

  222.   {% if 'ssh_keys' in user or

  223.       'ssh_auth' in user or

  224.       'ssh_auth_file' in user or

  225.       'ssh_auth_pillar' in user or

  226.       'ssh_auth.absent' in user or

  227.       'ssh_config' in user %}

  228. user_keydir_{{ name }}:

  229.   file.directory:

  230.     - name: {{ home }}/.ssh

  231.     - user: {{ name }}

  232.     - group: {{ user_group }}

  233.     - makedirs: True

  234.     - mode: '0700'

  235.     - dir_mode: '0700'

  236.     - require:

  237.       - user: {{ name }}

  238.       - group: {{ user_group }}

  239.       {%- for group in user.get('groups', []) %}

  240.       - group: {{ group }}

  241.       {%- endfor %}

  242.   {% endif %}

  243. 

  244.   {% if 'ssh_keys' in user %}

  245.     {% for _key in user.ssh_keys.keys() %}

  246.       {% if _key == 'privkey' %}

  247.         {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') %}

  248.       {% elif _key ==  'pubkey' %}

  249.         {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') + '.pub' %}

  250.       {% else %}

  251.         {% set key_name = _key %}

  252.       {% endif %}

  253. users_{{ name }}_{{ key_name }}_key:

  254.   file.managed:

  255.     - name: {{ home }}/.ssh/{{ key_name }}

  256.     - user: {{ name }}

  257.     - group: {{ user_group }}

  258.       {% if key_name.endswith(".pub") %}

  259.     - mode: '0644'

  260.       {% else %}

  261.     - mode: '0600'

  262.       {% endif %}

  263.     - show_diff: False

  264.     {%- set key_value = salt['pillar.get']('users:'+name+':ssh_keys:'+_key) %}

  265.     {%- if 'salt://' in key_value[:7] %}

  266.     - source: {{ key_value }}

  267.     {%- else %}

  268.     - contents_pillar: users:{{ name }}:ssh_keys:{{ _key }}

  269.     {%- endif %}

  270.     - require:

  271.       - user: users_{{ name }}_user

  272.       {% for group in user.get('groups', []) %}

  273.       - group: users_{{ name }}_{{ group }}_group

  274.       {% endfor %}

  275.     {% endfor %}

  276.   {% endif %}

  277. 

  278. 

  279. {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %}

  280. users_authorized_keys_{{ name }}:

  281.   file.managed:

  282.     - name: {{ home }}/.ssh/authorized_keys

  283.     - user: {{ name }}

  284.     - group: {{ user_group }}

  285.     - mode: '0600'

  286. {% if 'ssh_auth_file' in user %}

  287.     - contents: |

  288.         {% for auth in user.ssh_auth_file -%}

  289.         {{ auth }}

  290.         {% endfor -%}

  291. {% else %}

  292.     - contents: |

  293.         {%- for key_name, pillar_name in user['ssh_auth_pillar'].items() %}

  294.         {{ salt['pillar.get'](pillar_name + ':' + key_name + ':pubkey', '') }}

  295.         {%- endfor %}

  296. {% endif %}

  297. {% endif %}

  298. 

  299. {% if 'ssh_auth' in user %}

  300. {% for auth in user['ssh_auth'] %}

  301. users_ssh_auth_{{ name }}_{{ loop.index0 }}:

  302.   ssh_auth.present:

  303.     - user: {{ name }}

  304.     - name: {{ auth }}

  305.     - require:

  306.         - file: user_keydir_{{ name }}

  307.         - user: users_{{ name }}_user

  308. {% endfor %}

  309. {% endif %}

  310. 

  311. {% if 'ssh_keys_pillar' in user %}

  312. {% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}

  313. user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:

  314.   file.managed:

  315.     - name: {{ home }}/.ssh/{{ key_name }}

  316.     - user: {{ name }}

  317.     - group: {{ user_group }}

  318.     - mode: '0600'

  319.     - show_diff: False

  320.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey

  321.     - require:

  322.       - user: users_{{ name }}_user

  323.       {% for group in user.get('groups', []) %}

  324.       - group: users_{{ name }}_{{ group }}_group

  325.       {% endfor %}

  326. user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:

  327.   file.managed:

  328.     - name: {{ home }}/.ssh/{{ key_name }}.pub

  329.     - user: {{ name }}

  330.     - group: {{ user_group }}

  331.     - mode: '0644'

  332.     - show_diff: False

  333.     - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey

  334.     - require:

  335.       - user: users_{{ name }}_user

  336.       {% for group in user.get('groups', []) %}

  337.       - group: users_{{ name }}_{{ group }}_group

  338.       {% endfor %}

  339. {% endfor %}

  340. {% endif %}

  341. 

  342. {% if 'ssh_auth_sources' in user %}

  343. {% for pubkey_file in user['ssh_auth_sources'] %}

  344. users_ssh_auth_source_{{ name }}_{{ loop.index0 }}:

  345.   ssh_auth.present:

  346.     - user: {{ name }}

  347.     - source: {{ pubkey_file }}

  348.     - require:

  349.         {% if createhome -%}

  350.         - file: users_{{ name }}_user

  351.         {% endif -%}

  352.         - user: users_{{ name }}_user

  353. {% endfor %}

  354. {% endif %}

  355. 

  356. {% if 'ssh_auth_sources.absent' in user %}

  357. {% for pubkey_file in user['ssh_auth_sources.absent'] %}

  358. users_ssh_auth_source_delete_{{ name }}_{{ loop.index0 }}:

  359.   ssh_auth.absent:

  360.     - user: {{ name }}

  361.     - source: {{ pubkey_file }}

  362.     - require:

  363.         {% if createhome -%}

  364.         - file: users_{{ name }}_user

  365.         {% endif -%}

  366.         - user: users_{{ name }}_user

  367. {% endfor %}

  368. {% endif %}

  369. 

  370. {% if 'ssh_auth.absent' in user %}

  371. {% for auth in user['ssh_auth.absent'] %}

  372. users_ssh_auth_delete_{{ name }}_{{ loop.index0 }}:

  373.   ssh_auth.absent:

  374.     - user: {{ name }}

  375.     - name: {{ auth }}

  376.     - require:

  377.         {% if createhome -%}

  378.         - file: users_{{ name }}_user

  379.         {% endif -%}

  380.         - user: users_{{ name }}_user

  381. {% endfor %}

  382. {% endif %}

  383. 

  384. {% if 'ssh_config' in user %}

  385. users_ssh_config_{{ name }}:

  386.   file.managed:

  387.     - name: {{ home }}/.ssh/config

  388.     - user: {{ name }}

  389.     - group: {{ user_group }}

  390.     - mode: '0640'

  391.     - contents: |

  392.         # Managed by Saltstack

  393.         # Do Not Edit

  394.         {% for label, setting in user.ssh_config.items() %}

  395.         # {{ label }}

  396.         Host {{ setting.get('hostname') }}

  397.           {%- for opts in setting.get('options') %}

  398.           {{ opts }}

  399.           {%- endfor %}

  400.         {% endfor -%}

  401. {% endif %}

  402. 

  403. {% if 'ssh_known_hosts' in user %}

  404. {% for hostname, host in user['ssh_known_hosts'].items() %}

  405. users_ssh_known_hosts_{{ name }}_{{ loop.index0 }}:

  406.   ssh_known_hosts.present:

  407.     - user: {{ name }}

  408.     - name: {{ hostname }}

  409.     {% if 'port' in host %}

  410.     - port: {{ host['port'] }}

  411.     {% endif -%}

  412.     {% if 'fingerprint' in host %}

  413.     - fingerprint: {{ host['fingerprint'] }}

  414.     {% endif -%}

  415.     {% if 'key' in host %}

  416.     - key: {{ host['key'] }}

  417.     {% endif -%}

  418.     {% if 'enc' in host %}

  419.     - enc: {{ host['enc'] }}

  420.     {% endif -%}

  421.     {% if 'hash_known_hosts' in host %}

  422.     - hash_known_hosts: {{ host['hash_known_hosts'] }}

  423.     {% endif -%}

  424.     {% if 'timeout' in host %}

  425.     - timeout: {{ host['timeout'] }}

  426.     {% endif -%}

  427.     {% if 'fingerprint_hash_type' in host %}

  428.     - fingerprint_hash_type: {{ host['fingerprint_hash_type'] }}

  429.     {% endif -%}

  430. {% endfor %}

  431. {% endif %}

  432. 

  433. {% if 'ssh_known_hosts.absent' in user %}

  434. {% for host in user['ssh_known_hosts.absent'] %}

  435. users_ssh_known_hosts_delete_{{ name }}_{{ loop.index0 }}:

  436.   ssh_known_hosts.absent:

  437.     - user: {{ name }}

  438.     - name: {{ host }}

  439. {% endfor %}

  440. {% endif %}

  441. {% endif %}

  442. 

  443. {% set sudoers_d_filename = name|replace('.','_') %}

  444. {% if 'sudouser' in user and user['sudouser'] %}

  445. 

  446. users_sudoer-{{ name }}:

  447.   file.managed:

  448.     - replace: False

  449.     - name: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  450.     - user: root

  451.     - group: {{ users.root_group }}

  452.     - mode: '0440'

  453. {% if 'sudo_rules' in user or 'sudo_defaults' in user %}

  454. #{#%

  455. {% if 'sudo_rules' in user %}

  456. {% for rule in user['sudo_rules'] %}

  457. "validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":

  458.   cmd.run:

  459.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  460.     - stateful: True

  461.     - shell: {{ users.visudo_shell }}

  462.     - env:

  463.       # Specify the rule via an env var to avoid shell quoting issues.

  464.       - rule: "{{ name }} {{ rule }}"

  465.     - require_in:

  466.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  467. {% endfor %}

  468. {% endif %}

  469. {% if 'sudo_defaults' in user %}

  470. {% for entry in user['sudo_defaults'] %}

  471. "validate {{ name }} sudo Defaults {{ loop.index0 }} {{ name }} {{ entry }}":

  472.   cmd.run:

  473.     - name: 'visudo -cf - <<<"$rule" | { read output; if [[ $output != "stdin: parsed OK" ]] ; then echo $output ; fi }'

  474.     - stateful: True

  475.     - shell: {{ users.visudo_shell }}

  476.     - env:

  477.       # Specify the rule via an env var to avoid shell quoting issues.

  478.       - rule: "Defaults:{{ name }} {{ entry }}"

  479.     - require_in:

  480.       - file: users_{{ users.sudoers_dir }}/{{ name }}

  481. {% endfor %}

  482. {% endif %}

  483. #%#}

  484. 

  485. users_{{ users.sudoers_dir }}/{{ name }}:

  486.   file.managed:

  487.     - replace: True

  488.     - name: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  489.     - contents: |

  490.       {%- if 'sudo_defaults' in user %}

  491.       {%- for entry in user['sudo_defaults'] %}

  492.         Defaults:{{ name }} {{ entry }}

  493.       {%- endfor %}

  494.       {%- endif %}

  495.       {%- if 'sudo_rules' in user %}

  496.         ########################################################################

  497.         # File managed by Salt (users-formula).

  498.         # Your changes will be overwritten.

  499.         ########################################################################

  500.         #

  501.       {%- for rule in user['sudo_rules'] %}

  502.         {{ name }} {{ rule }}

  503.       {%- endfor %}

  504.       {%- endif %}

  505.     - require:

  506.       - file: users_sudoer-defaults

  507.       - file: users_sudoer-{{ name }}

  508.   cmd.wait:

  509.     - name: visudo -cf {{ users.sudoers_dir }}/{{ sudoers_d_filename }} || ( rm -rvf {{ users.sudoers_dir }}/{{ sudoers_d_filename }}; exit 1 )

  510.     - watch:

  511.       - file: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  512. {% endif %}

  513. {% else %}

  514. users_{{ users.sudoers_dir }}/{{ sudoers_d_filename }}:

  515.   file.absent:

  516.     - name: {{ users.sudoers_dir }}/{{ sudoers_d_filename }}

  517. {% endif %}

  518. 

  519. {%- if not grains['os_family'] in ['RedHat', 'Suse'] %}

  520. {%-   if 'google_auth' in user %}

  521. {%-     for svc in user['google_auth'] %}

  522. users_googleauth-{{ svc }}-{{ name }}:

  523.   file.managed:

  524.     - replace: false

  525.     - name: {{ users.googleauth_dir }}/{{ name }}_{{ svc }}

  526.     - contents_pillar: 'users:{{ name }}:google_auth:{{ svc }}'

  527.     - user: root

  528.     - group: {{ users.root_group }}

  529.     - mode: '0400'

  530.     - require:

  531.       - pkg: users_googleauth-package

  532. {%-     endfor %}

  533. {%-   endif %}

  534. {%- endif %}

  535. 

  536. # this doesn't work (Salt bug), therefore need to run state.apply twice

  537. #include:

  538. #  - users

  539. #

  540. #git:

  541. #  pkg.installed:

  542. #    - require_in:

  543. #      - sls: users

  544. #

  545. {% if salt['cmd.has_exec']('git') %}

  546. 

  547. {% if 'gitconfig' in user %}

  548. {% for key, value in user['gitconfig'].items() %}

  549. users_{{ name }}_user_gitconfig_{{ loop.index0 }}:

  550.   {% if grains['saltversioninfo'] >= [2015, 8, 0, 0] %}

  551.   git.config_set:

  552.   {% else %}

  553.   git.config:

  554.   {% endif %}

  555.     - name: {{ key }}

  556.     - value: "{{ value }}"

  557.     - user: {{ name }}

  558.     {% if grains['saltversioninfo'] >= [2015, 8, 0, 0] %}

  559.     - global: True

  560.     {% else %}

  561.     - is_global: True

  562.     {% endif %}

  563. {% endfor %}

  564. {% endif %}

  565. 

  566. {% if 'gitconfig.absent' in user and grains['saltversioninfo'] >= [2015, 8, 0, 0] %}

  567. {% for key in user.get('gitconfig.absent') %}

  568. users_{{ name }}_user_gitconfig_absent_{{ key }}:

  569.   git.config_unset:

  570.     - name: '{{ key }}'

  571.     - user: {{ name }}

  572.     - global: True

  573.     - all: True

  574. {% endfor %}

  575. {% endif %}

  576. 

  577. {% endif %}

  578. 

  579. {% endfor %}

  580. 

  581. {#- create directories for homes #}

  582. {%- for dir in create_dirs|unique|reject('equalto', '/') %}

  583. users_prereq_dir_{{ dir }}:

  584.   file.directory:

  585.     - name: {{ dir }}

  586.     - makedirs: True

  587. {%- endfor %}

  588. 

  589. 

  590. {% for name, user in pillar.get('users', {}).items()

  591.         if user.absent is defined and user.absent %}

  592. users_absent_user_{{ name }}:

  593. {% if 'purge' in user or 'force' in user %}

  594.   user.absent:

  595.     - name: {{ name }}

  596.     {% if 'purge' in user %}

  597.     - purge: {{ user['purge'] }}

  598.     {% endif %}

  599.     {% if 'force' in user %}

  600.     - force: {{ user['force'] }}

  601.     {% endif %}

  602. {% else %}

  603.   user.absent:

  604.     - name: {{ name }}

  605. {% endif -%}

  606. users_{{ users.sudoers_dir }}/{{ name }}:

  607.   file.absent:

  608.     - name: {{ users.sudoers_dir }}/{{ name }}

  609. {% endfor %}

  610. 

  611. {% for user in pillar.get('absent_users', []) %}

  612. users_absent_user_2_{{ user }}:

  613.   user.absent:

  614.     - name: {{ user }}

  615. users_2_{{ users.sudoers_dir }}/{{ user }}:

  616.   file.absent:

  617.     - name: {{ users.sudoers_dir }}/{{ user }}

  618. {% endfor %}

  619. 

  620. {% for group in pillar.get('absent_groups', []) %}

  621. users_absent_group_{{ group }}:

  622.   group.absent:

  623.     - name: {{ group }}

  624. {% endfor %}