Ansible Role Baseline

Configurable base packages, timezone, administrative users, SSH keys, sudo access, and Debian automatic upgrade scheduling for SPIE DataSolutions.

Requirements

• Debian/Ubuntu or Red Hat family hosts, with gathered facts and become privileges.
• Ansible collections from requirements.yml.
• systemd for the optional Debian upgrade timer.
• Package availability depends on the distribution version and enabled repositories; override baseline_packages where needed.

Quick Start

ansible-galaxy collection install -r requirements.yml

Use the role from a playbook with become: true and gather_facts: true:

---
- name: Apply the Linux baseline
  hosts: all
  become: true
  gather_facts: true
  roles:
    - role: ansible-role-baseline

The example assumes the role is available as ansible-role-baseline in your roles path. Inventory variables retain the names timezone, sudo_group, users, and removed_users. users, host_users, and removed_users default to empty lists.

Role Variables

See defaults/main.yml for the complete defaults.

timezone: Europe/Amsterdam
users:
  - name: administrator
    keys: ssh-ed25519 AAAA... administrator@example.org
    # keys_file: files/administrator.pub
    # keys_url: https://example.org/administrator.keys
    # password: "<encrypted password hash from Ansible Vault>"
    # home: /home/administrator
    # shell: /bin/bash
    # groups: [operators]
removed_users: []

baseline_passwordless_sudo: true
baseline_apt_cache_valid_time: 604800
baseline_apt_upgrade_timer: true
baseline_apt_upgrade_on_calendar: '*-*-* 06:00:00'
baseline_apt_upgrade_randomized_delay: 30m

Managed users join the administrative group and systemd-journal, retaining existing supplementary groups. Passwords must be encrypted hashes; keep them in Vault. Omitting a password preserves an existing password and leaves a newly created account password-locked according to the user module defaults. SSH keys are additive.

Use keys to supply a public SSH key directly. Multiple public keys can be supplied as a YAML multiline string:

users:
  - name: administrator
    keys: |
      ssh-ed25519 AAAA... administrator@laptop
      ssh-ed25519 AAAA... administrator@desktop

Replace the abbreviated examples with complete public keys. keys_file (controller file) and keys_url remain optional alternatives and can also be used alongside keys.

Passwordless sudo is enabled by default for the configured administrative group and validated with visudo before saving. Setting baseline_passwordless_sudo: false removes only this role's /etc/sudoers.d/passwordless file; other sudo rules still apply.

removed_users explicitly deletes named users and their home directories. Root and names also listed in users are rejected. Existing .bashrc files are preserved as a Bash fallback.

Group and Host Users

Define shared accounts in the group's users list, then additional accounts under a different variable, host_users, in each host's inventory:

# group_vars/docker.yml
users:
  - name: administrator
    keys: ssh-ed25519 AAAA... administrator@example.org

# host_vars/aq-noc-bw01.yml
host_users:
  - name: hostoperator
    keys: ssh-ed25519 AAAA... hostoperator@example.org

The role uses baseline_users = users + host_users for accounts and all authorized key sources. Do not redefine users in host_vars to add users: Ansible would replace the group list. Usernames must be unique across both lists and cannot also appear in removed_users. Removing an entry from either list does not delete the account; select account deletion explicitly through removed_users.

Managed users default to /usr/bin/zsh. The role installs Zsh and a shared, root-owned Oh My Zsh checkout in /usr/local/share/oh-my-zsh, and manages .zshrc for every account in users and host_users with the bira theme and git plugin. Existing .zshrc files are backed up before replacement. Explicit shell overrides remain supported. Other existing accounts (including root unless listed) are unchanged.

Set baseline_zsh_theme to choose another theme and baseline_oh_my_zsh_version to pin a release or commit (default: master). Ansible updates the shared checkout; interactive automatic updates are disabled. Target hosts need HTTPS access to GitHub. Custom package lists must include zsh and git.

Packages

baseline_packages combines baseline_packages_common with the matching baseline_packages_by_os_family entry:

Scope	Default packages
Common	zsh, git, lolcat, figlet, tar, sudo, bash-completion, jq, unzip, btop
Debian family	htop, tree, neovim, autojump, ripgrep, cron-apt, unattended-upgrades
Red Hat family	vim-enhanced

Override baseline_packages to supply a complete custom list. Configure any extra repositories required by your distribution before running the role. The Debian package cache is refreshed only when older than baseline_apt_cache_valid_time, which defaults to seven days.

Automatic Upgrades

On Debian-family systemd hosts, the role schedules apt-daily-upgrade.timer at 06:00 host local time with up to 30 minutes of randomized delay. Timer changes reload systemd and restart/enable the timer. The role does not define the allowed origins or other unattended-upgrades policies; manage those separately. Setting baseline_apt_upgrade_timer: false stops managing the existing override and does not remove it or disable the timer.

Task Structure

tasks/main.yml statically imports the following files in order:

Task file	Responsibility
validate.yml	Validate OS family, administrative group, unique usernames, and managed/removed user lists.
packages.yml	Refresh the Debian package cache and install the effective package list.
timezone.yml	Configure the system timezone.
sudo.yml	Create the administrative group and manage validated passwordless sudo.
users.yml	Manage accounts and additive SSH keys, Zsh configuration, and explicit user removal.
automatic_upgrades.yml	Validate and configure the Debian systemd upgrade timer.

handlers/main.yml reloads systemd before restarting the upgrade timer when its configuration changes. The timer drop-in is rendered from apt-timer-override.conf.j2.

Validation

From your playbook project, validate before applying the role:

ansible-playbook -i inventory.ini baseline.yml --syntax-check
ansible-playbook -i inventory.ini baseline.yml --check --diff --limit testhost

Save the example playbook as baseline.yml and provide your own inventory. Check mode on a fresh host may encounter missing files or commands when package installation is skipped. Verify sudo, a fresh SSH login, timezone, and timer scheduling before production deployment. Full Debian/Rocky execution has not been validated here.

License

MIT - See LICENSE file for details.

Copyright (c) 2026 SPIE DataSolutions B.V.

Changelog

See CHANGELOG.md for a list of all notable changes to this project.

Security

Please see our Security Policy for reporting security vulnerabilities.

Contributing

Please read our Contributing Guide and Code of Conduct before submitting a Pull Request.

Support

For questions or support, contact: support.ds.nl@spie.com