{"id":19015151,"url":"https://github.com/adfinis/ansible-role-users","last_synced_at":"2026-01-29T12:17:27.445Z","repository":{"id":68508317,"uuid":"131693016","full_name":"adfinis/ansible-role-users","owner":"adfinis","description":"Ansible role users","archived":false,"fork":false,"pushed_at":"2023-11-06T09:57:26.000Z","size":72,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-03-30T08:33:20.139Z","etag":null,"topics":["ansible","ansible-galaxy","ansible-role","automation","infrastructure"],"latest_commit_sha":null,"homepage":"https://docs.adfinis-sygroup.ch/public/ansible-guide/adfinis-sygroup.users.yml.html","language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/adfinis.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":"CONTRIBUTING.md","funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-01T08:47:30.000Z","updated_at":"2023-08-07T07:58:11.000Z","dependencies_parsed_at":"2023-11-06T10:46:04.865Z","dependency_job_id":"33dcf69a-727f-4c7f-b14c-ff08e5f0614e","html_url":"https://github.com/adfinis/ansible-role-users","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/adfinis/ansible-role-users","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adfinis%2Fansible-role-users","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adfinis%2Fansible-role-users/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adfinis%2Fansible-role-users/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adfinis%2Fansible-role-users/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/adfinis","download_url":"https://codeload.github.com/adfinis/ansible-role-users/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/adfinis%2Fansible-role-users/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28877319,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-29T10:31:27.438Z","status":"ssl_error","status_checked_at":"2026-01-29T10:31:01.017Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-galaxy","ansible-role","automation","infrastructure"],"created_at":"2024-11-08T19:35:49.128Z","updated_at":"2026-01-29T12:17:27.433Z","avatar_url":"https://github.com/adfinis.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"users\n=====\n\nThis role sets up customer and Adfinis user accounts.\n\n\nRequirements\n------------\n\nThis role assumes that there is an initial non-root user with sudo permissions\npresent on the system (`{{users_default_user}}`, see *Role Variables* below).\n\nThat user is used for the initial user accounts setup and then deleted. The\ndeletion happens in the last task of this role (so an initial run will work\nfine, but if repeated, login will fail).\n\nIn a playbook (or series of playbook), it is therefore recommended to apply this\nrole in two variants:\n\n 1. The first time, apply with `remote_user: {{users_default_user}}`.\n\n 2. After than, apply with the intended user (either the personal account, or\n    `root`, if allowed).\n\nIt is recommended to keep a playbook/play around for the initial setup, and a\nplaybook/play for continuous management.\n\n\nRole Dependencies\n-----------------\n\n*(none)*\n\n\nRole Variables\n--------------\n\n### Mandatory\n\n * `users_root_password_salt` (string, default: *unset*):\u003cbr /\u003e\n   Salt to be used for hashing the root password.\u003cbr /\u003e\n   **Note**: Only required if `users_configure_root` is true,\n   `users_root_password` is set and `users_root_password_is_hashed` is false.\n\n * `users_customer_group` (string):\u003cbr /\u003e\n   Name of the system group to which all customer user accounts are added.\u003cbr /\u003e\n   **Note**: Only required if `users_configure_root` is true and\n   `users_customer` is non-empty.\n\n### Optional\n\n * `users_configure_root` (boolean, default: false):\u003cbr /\u003e\n   If this is set to false, anything related to the root account is skipped. If\n   set to true, the account is configured according to the `users_root…`\n   variables.\n\n * `users_root_password` (string, default: *unset*):\u003cbr /\u003e\n   If this is unset, the root password is not changed.\u003cbr /\u003e\n   If this is set and `users_root_password_is_hashed` is false, this is the\n   password in clear-text, and `users_root_password_salt` must also be set.\u003cbr\n   /\u003e\n   If this is set and `users_root_password_is_hashed` is true, this is assumed\n   to be a hashed password (as produced by\n   [`ansible.builtin.password_hash`][ansible:filter:password_hash]).\n\n * `users_root_password_is_hashed` (boolean, default: `false`):\u003cbr /\u003e\n   If set to `true`, `users_root_password` is assumed to have been hashed\n   already (in this case, `users_root_password_salt` is not required).\n\n * `users_root_authorized_keys` (list, default: `[]`):\u003cbr /\u003e\n   SSH public keys that will be given authorisation to log in as `root`.\u003cbr /\u003e\n   Each list element is an object with the following properties:\n    - `key` (string, mandatory):\u003cbr /\u003e\n      Key data itself.\n    - `comment` (string, optional, default: *unset*):\u003cbr /\u003e\n      Comment, appended to the key line (usually `user@host`).\n    - `description` (string, optional, default: *unset*):\u003cbr /\u003e\n      Human-readable description to be placed as a comment in the\n      `authorized_keys` file above the key line.\n    - `options` (string, optional, default: *unset*):\u003cbr /\u003e\n      Key options string to be prepended to the key line.\n\n * `users_configure_adfinis` (boolean, default: false):\u003cbr /\u003e\n   If this is set to false, anything related to the Adfinis user accounts is\n   skipped. If set to true, the user accounts are created/deleted/configured\n   according to the `users_adfinis…` variables.\n\n * `users_adfinis` (list, default: `[]`):\u003cbr /\u003e\n   Adfinis user accounts to be set up. Each user will be added to the\n   `{{users_adfinis_group}}` system group. Conversely, **every existing\n   non-system user in that group that is not listed in this variable will be\n   deleted**.\u003cbr /\u003e\n   Each list element is an object with the following properties:\n    - `username` (string, mandatory):\u003cbr /\u003e\n      User account name.\n    - `authorized_keys` (list, default: `[]`):\u003cbr /\u003e\n      SSH public keys that will be given authorisation to log in as `root`.\u003cbr\n      /\u003e\n      Each list element is an object with properties as described in\n      `users_root_authorized_keys`.\n\n * `users_adfinis_group` (string, default: `adfinis`):\u003cbr /\u003e\n   Name of the system group to which all Adfinis user accounts are added.\n\n * `users_adfinis_ssh_pubkey_options` (string, default: *unset*):\u003cbr /\u003e\n   Key options string to be prepended to *all* key lines.\n\n * `users_adfinis_homedir_mode` (file permission mode, default: `0700`):\u003cbr /\u003e\n   File permission mode for the home directory of each Adfinis user.\u003cbr /\u003e\n   **Note**: Because of a historical issue with Jinja2, the octal representation\n   of the mode must either be passed as string (to ensure it is not incorrectly\n   transformed), or [this Ansible option][ansible:vars:default_jinja2_native]\n   must be set to true.\n\n * `users_adfinis_unrestricted_sudo` (boolean, default: `true`):\u003cbr /\u003e\n   Whether or not the Adfinis users are given unrestricted `sudo` permissions.\n\n * `users_adfinis_user_remove_home` (boolean, default: `false`):\u003cbr /\u003e\n   Whether or not to delete the home directory as well when deleting an unlisted\n   Adfinis account.\n\n * `users_configure_customers` (boolean, default: false):\u003cbr /\u003e\n   If this is set to false, anything related to the customer user accounts is\n   skipped. If set to true, the user accounts are created/configured according\n   to the `users_customer…` variables.\n\n * `users_customer` (list, default: `[]`):\u003cbr /\u003e\n   Adfinis user accounts to be set up. Each user will be added to the\n   `{{users_customer_group}}` system group.\u003cbr /\u003e\n   Each list element is an object with properties as described in\n   `users_adfinis`.\n\n * `users_customer_homedir_mode` (file permission mode, default: `0755`):\u003cbr /\u003e\n   File permission mode for the home directory of each customer user.\u003cbr /\u003e\n   The default keeps it world-readable so that customers can use `sudo -u` to\n   run commands as other users and still pass files in their home directory.\u003cbr\n   /\u003e\n   **Note**: Because of a historical issue with Jinja2, the octal representation\n   of the mode must either be passed as string (to ensure it is not incorrectly\n   transformed), or [this Ansible option][ansible:vars:default_jinja2_native]\n   must be set to true.\n\n * `users_customer_unrestricted_sudo` (boolean, default: `false`):\u003cbr /\u003e\n   Whether or not the customer users are given unrestricted `sudo` permissions.\n\n * `users_default_user` (string, default: `adfinis`):\u003cbr /\u003e\n   Name of initially existing non-root user account on system, to be deleted.\n\n * `users_default_user_remove_home` (boolean, default: `false`):\u003cbr /\u003e\n   Whether or not to delete the initially existing non-root user account's\n   home directory as well.\n\n\nRole Tags\n---------\n\n * `init`: Same as `role::users:root` and `role::users:adfinis` combined.\n * `role::users`: All tasks in this role.\n * `role::users:root`: All tasks that set up the root user account.\n * `role::users:adfinis`: All tasks that set up the Adfinis user accounts.\n * `role::users:adfinis:create`: All tasks that set up the Adfinis user accounts\n   (without deleting).\n * `role::users:adfinis:delete`: All tasks that delete superfluous Adfinis\n   user accounts.\n * `role::users:customer`: All tasks that set up customer user accounts.\n * `role::users:default`: All tasks that clean up the default user account.\n\n\nSupport Policy\n--------------\n\nOnly the latest release is maintained and supported (see the [Tags\npage](https://github.com/adfinis/ansible-role-users/tags)).\n\nOnce a new release is made, the previous release branch no longer receives any\nbugfixes.\n\n\n[ansible:vars:default_jinja2_native]: https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-jinja2-native\n[ansible:filter:password_hash]: https://docs.ansible.com/ansible/latest/collections/ansible/builtin/password_hash_filter.html\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadfinis%2Fansible-role-users","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fadfinis%2Fansible-role-users","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadfinis%2Fansible-role-users/lists"}