fixed user creation, some rc files, use hcloud host vars (ipv6)

roles/user/bin/user.sh

@@ -0,0 +1,128 @@
+#!/bin/sh
+
+rootdir=""
+user=""
+groups=""
+home=""
+shell="/usr/local/bin/bash"
+comment=""
+action=""
+
+usage() {
+    echo "Usage: $0 -u user [-h home] [-s shell] [-g groups] [-d rootdir] [-c comment] -a action"
+    echo "Valid actions: present, absent, locked"
+    exit 1
+}
+
+getuid() {
+    local root="$1"
+    local user="$2"
+    pw $root show user "$user" -7 | cut -d: -f 3
+}
+
+run() {
+    echo $*
+    $*
+}
+
+OPTIND=1
+while getopts d:u:h:g:s:c:a: opt ; do
+    case $opt in
+        d)
+            rootdir="$OPTARG"
+            ;;
+        u)
+            user="$OPTARG"
+            ;;
+        h)
+            home="$OPTARG"
+            ;;
+        g)
+            groups="$OPTARG"
+            ;;
+        s)
+            shell="$OPTARG"
+            ;;
+        c)
+            comment="$OPTARG"
+            ;;
+        a)
+            action="$OPTARG"
+            ;;
+        *)
+            usage
+            ;;
+    esac
+done
+
+shift $(($OPTIND - 1))
+
+if test -z "$user" -o -z "$action"; then
+    usage
+fi
+
+args=""
+root=""
+
+if test -n "$rootdir"; then
+    root="-R $rootdir"
+fi
+
+if test -n "$groups"; then
+    args="-G $groups"
+fi
+
+if test -n "$home"; then
+    args="$args -d $home -k /etc/skel -m -M 700"
+else
+    args="$args -d /home/$user -k /etc/skel -m -M 700"
+fi
+
+if test -n "$shell"; then
+    args="$args -s $shell"
+else
+    args="$args -s /usr/local/bin/bash"
+fi
+
+if test -n "$comment"; then
+    args="$args -c $comment"
+fi
+
+case "$action" in
+    present)
+        set -x
+        if pw $root user show "$user" > /dev/null 2>&1; then
+            if pw $root user show "$user" | grep -q LOCKED; then
+                run pw unlock "$user"
+            else
+                echo "$user exists."
+            fi
+        else
+            run pw $root user add "$user" $args
+        fi
+
+        if test -e "/usr/local/bastille/keys/$user" -a ! -e "/home/$user/.ssh/authorized_keys"; then
+            uid=$(getuid "$root" "$user")
+            install -m 700 -o "$uid" -g "$uid" -d "/home/$user/.ssh"
+            install -m 600 -o "$uid" -g "$uid" "/usr/local/bastille/keys/$user" "/home/$user/.ssh/authorized_keys"
+        fi
+        set +x
+        ;;
+    absent)
+        if pw $root user show "$user" > /dev/null 2>&1; then
+            run pw $root user del "$user"
+        fi
+        ;;
+    locked)
+        if pw $root user show "$user" > /dev/null 2>&1; then
+            if pw $root user show "$user" | grep -q LOCKED; then
+                echo "$user is already locked."
+            else
+                run pw lock "$user"
+            fi
+        fi
+        ;;
+    *)
+        usage
+        ;;
+esac

roles/user/files/keys/tom

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCfY4Oxp6LnFvdAOhs2hcFmQ31VyMPQmg4/6eU0LaNioroK8iniGdfM1zw48uTKApD2z5iI8SCOae7VZaab9rWwz+BExpFRYMR013quWY89gie6HK7wa2lrKt4wuKsl26HwcWOwo1dCnxKRbVqSRWUCAm4D7iArUl7+9y/VqQIZWIVPyfiqRGPZ68wCMm/VvkZggE2No2XINbVd+Ts1ddOudRpeg2BHiYZ48JWLWlnMNiJAgVQEFaBemdj9OBt9ey81/iWGbGoPeUW113SuOgNL+YLwo2pcgeMHcwC+B184LcMdt1r2O4jsW7OemLfrazq2p3VfSdzOduVDQvdGsnqpFArHgM+kPFt4YIdn772lrlMkxSgK2mbCbSzNZoomdCyuwKUt6dA3b1PZF8L6uMJK7DOVGcmrjk9UUW/goZhg6Xw0tBxYYQlhVNyRTZNwUtqC8CTJ1/xUSEqzbRO2jOxWTJFrLFJPMr0FSrwFqfFN/1DMFa4Pqb+w5OTyfKS0usikpvFoE3Ct/MQkgb1YdFseui2ARpo7SgFD/t7plYb3FLJpP49gIgK3dg8g/uiFLwwbGE13hUrzagAKChmhgfbY/yhrc+ES3OZJExleXUhYD4CCTiYjghNoYcmW2+X6c1VbOULDCrDfCRErFBW2lPVsoRebd8B30SC8YeaHzmWFdQ== scip@tripod

roles/user/tasks/main.yaml

@@ -0,0 +1,19 @@
+---
+
+- name: copy user ssh keys
+  copy:
+    src: keys
+    dest: "/usr/local/bastille/"
+    
+# The normal  ansible user  module can't be  used here,  because we're
+# talking  about jail  users  here. I  tried to  patch  the module  to
+# support the  -R flag (https://github.com/ansible/ansible/pull/84371)
+# but it makes no sense. Every  single function needs to be patched so
+# that it works for jails.
+#
+# So, instead I'm just using this simple script, which does the job as
+# well.
+- name: Manage users
+  loop: "{{ users }}"
+  ansible.builtin.script: "bin/user.sh -u {{ item.name }} -g '{{ item.groups }}' -c {{ role_name }}-user -a {{ item.state }} -d /usr/local/bastille/jails/pubnix/root"
+