Saltstack Official Users Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

init.sls 4.0KB

11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
11 yıl önce
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159
  1. include:
  2. - users.sudo
  3. {% for name, user in pillar.get('users', {}).items() %}
  4. {%- if user == None -%}
  5. {%- set user = {} -%}
  6. {%- endif -%}
  7. {%- set home = user.get('home', "/home/%s" % name) -%}
  8. {%- if 'prime_group' in user and 'name' in user['prime_group'] %}
  9. {%- set user_group = user.prime_group.name -%}
  10. {%- else -%}
  11. {%- set user_group = name -%}
  12. {%- endif %}
  13. {% for group in user.get('groups', []) %}
  14. {{ name }}_{{ group }}_group:
  15. group:
  16. - name: {{ group }}
  17. - present
  18. {% endfor %}
  19. {{ name }}_user:
  20. file.directory:
  21. - name: {{ home }}
  22. - user: {{ name }}
  23. - group: {{ user_group }}
  24. - mode: 0755
  25. - require:
  26. - user: {{ name }}
  27. - group: {{ user_group }}
  28. group.present:
  29. - name: {{ user_group }}
  30. {%- if 'prime_group' in user and 'gid' in user['prime_group'] %}
  31. - gid: {{ user['prime_group']['gid'] }}
  32. {%- elif 'uid' in user %}
  33. - gid: {{ user['uid'] }}
  34. {%- endif %}
  35. user.present:
  36. - name: {{ name }}
  37. - home: {{ home }}
  38. - shell: {{ user.get('shell', '/bin/bash') }}
  39. {% if 'uid' in user -%}
  40. - uid: {{ user['uid'] }}
  41. {% endif -%}
  42. {% if 'prime_group' in user and 'gid' in user['prime_group'] -%}
  43. - gid: {{ user['prime_group']['gid'] }}
  44. {% else -%}
  45. - gid_from_name: True
  46. {% endif -%}
  47. {% if 'fullname' in user %}
  48. - fullname: {{ user['fullname'] }}
  49. {% endif -%}
  50. - groups:
  51. - {{ user_group }}
  52. {% for group in user.get('groups', []) -%}
  53. - {{ group }}
  54. {% endfor %}
  55. - require:
  56. - group: {{ user_group }}
  57. {% for group in user.get('groups', []) -%}
  58. - group: {{ group }}
  59. {% endfor %}
  60. user_keydir_{{ name }}:
  61. file.directory:
  62. - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh
  63. - user: {{ name }}
  64. - group: {{ user_group }}
  65. - makedirs: True
  66. - mode: 700
  67. - require:
  68. - user: {{ name }}
  69. - group: {{ user_group }}
  70. {%- for group in user.get('groups', []) %}
  71. - group: {{ group }}
  72. {%- endfor %}
  73. {% if 'ssh_keys' in user %}
  74. {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %}
  75. user_{{ name }}_private_key:
  76. file.managed:
  77. - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}
  78. - user: {{ name }}
  79. - group: {{ user_group }}
  80. - mode: 600
  81. - contents_pillar: users:{{ name }}:ssh_keys:privkey
  82. - require:
  83. - user: {{ name }}_user
  84. {% for group in user.get('groups', []) %}
  85. - group: {{ name }}_{{ group }}_group
  86. {% endfor %}
  87. user_{{ name }}_public_key:
  88. file.managed:
  89. - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_type }}.pub
  90. - user: {{ name }}
  91. - group: {{ user_group }}
  92. - mode: 644
  93. - contents_pillar: users:{{ name }}:ssh_keys:pubkey
  94. - require:
  95. - user: {{ name }}_user
  96. {% for group in user.get('groups', []) %}
  97. - group: {{ name }}_{{ group }}_group
  98. {% endfor %}
  99. {% endif %}
  100. {% if 'ssh_auth' in user %}
  101. {% for auth in user['ssh_auth'] %}
  102. ssh_auth_{{ name }}_{{ loop.index0 }}:
  103. ssh_auth.present:
  104. - user: {{ name }}
  105. - name: {{ auth }}
  106. - require:
  107. - file: {{ name }}_user
  108. - user: {{ name }}_user
  109. {% endfor %}
  110. {% endif %}
  111. {% if 'sudouser' in user and user['sudouser'] %}
  112. sudoer-{{ name }}:
  113. file.managed:
  114. - name: /etc/sudoers.d/{{ name }}
  115. - user: root
  116. - group: root
  117. - mode: '0440'
  118. {% if 'sudo_rules' in user %}
  119. /etc/sudoers.d/{{ name }}:
  120. file.append:
  121. - text:
  122. {% for rule in user['sudo_rules'] %}
  123. - "{{ name }} {{ rule }}"
  124. {% endfor %}
  125. - require:
  126. - file: sudoer-defaults
  127. - file: sudoer-{{ name }}
  128. {% endif %}
  129. {% else %}
  130. /etc/sudoers.d/{{ name }}:
  131. file.absent:
  132. - name: /etc/sudoers.d/{{ name }}
  133. {% endif %}
  134. {% endfor %}
  135. {% for user in pillar.get('absent_users', []) %}
  136. {{ user }}:
  137. user.absent
  138. /etc/sudoers.d/{{ user }}:
  139. file.absent:
  140. - name: /etc/sudoers.d/{{ user }}
  141. {% endfor %}
  142. {% for group in pillar.get('absent_groups', []) %}
  143. {{ group }}:
  144. group.absent
  145. {% endfor %}