adjusted users to match caladan

deploy.yml

@@ -22,5 +22,10 @@
   become_method: doas
   roles:
     - basic
+    - users
   vars:
+    users:
+      - rilla
+      - ansible
+      - woodpecker
     use_lbu: false

hosts.yml

@@ -9,6 +9,6 @@ all:
 
     caladan:
       ansible_host: caladan
-      ansible_user: rilla
+      ansible_user: ansible
       ansible_port: 22
       ansible_python_interpreter: /usr/bin/python3

roles/users/tasks/ansible.yml

@@ -11,7 +11,6 @@
     home: /var/lib/ansible
     password: "*"  # disabled password but can be accessed with SSH
     groups:
-      - ansible
       - wheel
 
 - name: make sure ansible owns its home

roles/users/tasks/main.yml

@@ -1,3 +1,12 @@
+- name: create group 'deploy'
+  group:
+    name: deploy
+    gid: 700
+
+- name: determine available groups
+  getent:
+    database: group
+
 - name: create users
   include_tasks: "{{ username }}.yml"
   loop: "{{ users }}"

roles/users/tasks/rilla.yml

@@ -10,9 +10,18 @@
     group: rilla
     home: /home/rilla
     groups:
-      - rilla
+      - deploy
       - wheel
 
+- name: additional groups to rilla
+  user:
+    name: rilla
+    groups: "{{item}}"
+    append: yes
+  when: item in ansible_facts.getent_group
+  with_items:
+    - docker
+
 - name: make sure rilla owns its home
   file:
     state: directory

roles/users/tasks/woodpecker.yml

@@ -11,7 +11,16 @@
     home: /var/lib/woodpecker
     password: "*"  # disabled password but can be accessed with SSH
     groups:
-      - woodpecker
+      - deploy
+
+- name: additional groups to woodpecker
+  user:
+    name: woodpecker
+    groups: "{{item}}"
+    append: yes
+  when: item in ansible_facts.getent_group
+  with_items:
+    - docker
 
 - name: make sure woodpecker owns its home
   file: