06034dec95
New roles: - workstation: Arch base (yay, UV, Hyprland, tiling tools, fonts, productivity apps, NVIDIA auto-detect, tmux + TPM) - dev_apps: optional dev tools (PyCharm, R/RStudio, databases) - claude_code: Claude Code CLI install/update via npm - user_bootstrap: fresh machine user setup (SSH key, sudo) CLI/shell/terminal setup excluded — handled by existing cli_modern role. workstation.yml runs cli_modern first, then workstation roles in phases. All roles tagged for selective deployment. Passes ansible-lint at production level.
32 lines
809 B
YAML
32 lines
809 B
YAML
---
|
|
# user_bootstrap — create user account, SSH key, sudo access
|
|
# Arch-only. Run on a fresh machine before other roles.
|
|
|
|
- name: Create user account
|
|
ansible.builtin.user:
|
|
name: "{{ bootstrap_user }}"
|
|
shell: /bin/bash
|
|
create_home: true
|
|
groups: wheel
|
|
append: true
|
|
|
|
- name: Set authorized SSH key
|
|
ansible.posix.authorized_key:
|
|
user: "{{ bootstrap_user }}"
|
|
state: present
|
|
key: "{{ bootstrap_ssh_pubkey }}"
|
|
when: bootstrap_ssh_pubkey | default('') | length > 0
|
|
|
|
- name: Allow passwordless sudo for wheel group
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/sudoers
|
|
line: "%wheel ALL=(ALL) NOPASSWD: ALL"
|
|
validate: "visudo -cf %s"
|
|
state: present
|
|
|
|
- name: Ensure SSH service is enabled
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: started
|
|
enabled: true
|