Dustin C. Hatch
f9e8c78e5a
Because the various "webapp.*" users' home directories are under `/srv/www`, the default SELinux context type is `httpd_sys_content_t`. The SSH daemon is not allowed to read files with this label, so it cannot load the contents of these users' `authorized_keys` files. To address this, we have to explicitly set the SELinux type to `ssh_home_t`.
46 lines
1.0 KiB
YAML
46 lines
1.0 KiB
YAML
- name: ensure rsync is installed
|
|
package:
|
|
name=rsync
|
|
state=present
|
|
tags:
|
|
- install
|
|
|
|
- name: ensure app group exists
|
|
group:
|
|
name=webapp.ebonfire
|
|
state=present
|
|
- name: ensure app user exists
|
|
user:
|
|
name=webapp.ebonfire
|
|
group=webapp.ebonfire
|
|
home=/srv/www/ebonfire.com
|
|
createhome=yes
|
|
state=present
|
|
|
|
- name: ensure app home directory permissions are set
|
|
file:
|
|
path=/srv/www/ebonfire.com
|
|
mode=0755
|
|
state=directory
|
|
|
|
- name: ensure publisher keys are trusted
|
|
authorized_key:
|
|
key: "{{ ebonfire_publisher_keys|join('\n') }}"
|
|
user: webapp.ebonfire
|
|
exclusive: true
|
|
- name: ensure authorized_keys file permissions are correct
|
|
file:
|
|
path: /srv/www/ebonfire.com/.ssh/authorized_keys
|
|
mode: '0600'
|
|
owner: webapp.ebonfire
|
|
group: webapp.ebonfire
|
|
setype: ssh_home_t
|
|
|
|
|
|
- name: ensure apache is configured to serve ebonfire.com
|
|
copy:
|
|
src=ebonfire.com.httpd.conf
|
|
dest=/etc/httpd/conf.d/ebonfire.com.conf
|
|
mode=0644
|
|
notify: reload httpd
|