The boards: flash and configure

- name: Upgrade all packages
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600
    upgrade: dist
- name: Install base packages
  ansible.builtin.apt:
    name:
      - unattended-upgrades
      - locales
    state: present
- name: Remove services we don't need
  ansible.builtin.apt:
    name:
      - avahi-daemon
      - bluez
    state: absent
    purge: true
- name: Turn on automatic security updates
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
    mode: "0644"
- name: Generate the system locale
  ansible.builtin.lineinfile:
    path: /etc/locale.gen
    regexp: "^#?\\s*{{ base_locale }} UTF-8"
    line: "{{ base_locale }} UTF-8"
  notify: Regenerate locales
- name: Set the system locale
  ansible.builtin.copy:
    dest: /etc/locale.conf
    content: "LANG={{ base_locale }}\n"
    mode: "0644"
- name: Stop accepting locale variables from SSH clients
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^AcceptEnv'
    state: absent
  notify: Restart ssh
- name: SSH hardening
  ansible.builtin.copy:
    dest: /etc/ssh/sshd_config.d/10-hardening.conf
    content: |
      PermitRootLogin no
      AllowUsers @ADMIN_USER@
      AuthenticationMethods publickey
      PasswordAuthentication no
      KbdInteractiveAuthentication no
      X11Forwarding no
      MaxAuthTries 3
      LoginGraceTime 30
    mode: "0644"
  notify: Restart ssh
- name: Create the timesyncd drop-in directory
  ansible.builtin.file:
    path: /etc/systemd/timesyncd.conf.d
    state: directory
    mode: "0755"
- name: Take time from the firewall
  ansible.builtin.copy:
    dest: /etc/systemd/timesyncd.conf.d/firewall.conf
    content: |
      [Time]
      NTP=192.168.5.1
    mode: "0644"
  notify: Restart timesyncd
- name: Disable Wi-Fi and Bluetooth in firmware
  ansible.builtin.blockinfile:
    path: /boot/firmware/config.txt
    marker: "# {mark} ANSIBLE base role"
    block: |
      [all]
      dtoverlay=disable-wifi
      dtoverlay=disable-bt
  notify: Reboot

- name: Remove swap and zram packages
  ansible.builtin.apt:
    name:
      - dphys-swapfile
      - rpi-swap
      - systemd-zram-generator
    state: absent
    purge: true
  notify: Reboot
- name: Turn off any active swap now
  ansible.builtin.command: swapoff -a
  when: ansible_facts['swaptotal_mb'] > 0
- name: Enable memory cgroups on the kernel command line
  ansible.builtin.lineinfile:
    path: /boot/firmware/cmdline.txt
    backrefs: true
    regexp: '^((?!.*cgroup_enable=memory).*)$'
    line: '\1 cgroup_enable=memory cgroup_memory=1'
  notify: Reboot
- name: Load kernel modules at boot
  ansible.builtin.copy:
    dest: /etc/modules-load.d/kubernetes.conf
    content: |
      overlay
      br_netfilter
    mode: "0644"
  notify: Reboot
- name: Kernel settings for Kubernetes networking
  ansible.builtin.copy:
    dest: /etc/sysctl.d/99-kubernetes.conf
    content: |
      net.bridge.bridge-nf-call-iptables = 1
      net.bridge.bridge-nf-call-ip6tables = 1
      net.ipv4.ip_forward = 1
    mode: "0644"
  notify: Reboot
- name: Install kernel headers meta-package (Falco builds its kmod driver against them)
  ansible.builtin.apt:
    name: linux-headers-rpi-2712
    state: present

- name: Install containerd
  ansible.builtin.apt:
    name: containerd
    state: present
    update_cache: true
- name: Read containerd's default configuration
  ansible.builtin.command: containerd config default
  register: containerd_default
  changed_when: false
  check_mode: false
  failed_when: containerd_default.rc != 0 and not ansible_check_mode
- name: Write containerd configuration with systemd cgroups
  ansible.builtin.copy:
    dest: /etc/containerd/config.toml
    content: "{{ containerd_default.stdout | replace('SystemdCgroup = false', 'SystemdCgroup = true') }}\n"
    mode: "0644"
  when: containerd_default.stdout | length > 0
  notify: Restart containerd
- name: Point crictl at containerd
  ansible.builtin.copy:
    dest: /etc/crictl.yaml
    content: |
      runtime-endpoint: unix:///run/containerd/containerd.sock
      image-endpoint: unix:///run/containerd/containerd.sock
    mode: "0644"
- name: Create the apt keyrings directory
  ansible.builtin.file:
    path: /etc/apt/keyrings
    state: directory
    mode: "0755"
- name: Add the Kubernetes signing key
  ansible.builtin.get_url:
    url: "https://pkgs.k8s.io/core:/stable:/v{{ k8s_minor_version }}/deb/Release.key"
    dest: /etc/apt/keyrings/kubernetes.asc
    mode: "0644"
- name: Add the Kubernetes package repository
  ansible.builtin.copy:
    dest: /etc/apt/sources.list.d/kubernetes.list
    content: "deb [signed-by=/etc/apt/keyrings/kubernetes.asc] https://pkgs.k8s.io/core:/stable:/v{{ k8s_minor_version }}/deb/ /\n"
    mode: "0644"
- name: Install kubeadm, kubelet and kubectl
  ansible.builtin.apt:
    name:
      - kubeadm
      - kubelet
      - kubectl
      - cri-tools
    state: present
    update_cache: true
- name: Hold the Kubernetes packages at their version
  ansible.builtin.dpkg_selections:
    name: "{{ item }}"
    selection: hold
  loop:
    - kubeadm
    - kubelet
    - kubectl
- name: Enable the kubelet
  ansible.builtin.service:
    name: kubelet
    enabled: true

# Moves the admin user off uid/gid 1000, which many container images use
# (OpenSearch among them). Sharing it would let the admin user read, change
# or delete the SIEM's data, and signal its processes, without sudo.
#
# Run it once, after the first Ansible run and BEFORE Kubernetes: usermod refuses
# while any process runs as the uid, and container processes count. The playbook
# never kills anything but the admin's own login sessions; if something else runs
# as the uid, it stops and lists it.
#
#   ansible-playbook move-admin-uid.yml -K --limit k8s-worker1    # one board first
#   ansible-playbook move-admin-uid.yml -K --limit k8s            # then the rest
#
# usermod refuses to change a user that is logged in, and Ansible logs in as
# that user. So a temporary user does the move, and is removed at the end.
# sshd allows extra AllowUsers lines to add up, so a drop-in lets it in for the move.
- name: 1. A temporary admin, with the same SSH key
  hosts: all
  become: true
  vars:
    admin_user: "{{ lookup('config', 'DEFAULT_REMOTE_USER') }}"
  tasks:
    - name: Temporary user
      ansible.builtin.user:
        name: uidmove
        shell: /bin/bash
    - name: Its .ssh folder
      ansible.builtin.file:
        path: /home/uidmove/.ssh
        state: directory
        owner: uidmove
        group: uidmove
        mode: "0700"
    - name: Its SSH key is the admin's
      ansible.builtin.copy:
        src: "/home/{{ admin_user }}/.ssh/authorized_keys"
        dest: /home/uidmove/.ssh/authorized_keys
        remote_src: true
        owner: uidmove
        group: uidmove
        mode: "0600"
    - name: Sudo without a password, for this user only, for the next few minutes
      ansible.builtin.copy:
        dest: /etc/sudoers.d/uidmove
        content: "uidmove ALL=(ALL) NOPASSWD: ALL\n"
        mode: "0440"
        validate: visudo -cf %s
    - name: Let it log in over SSH (the base role allows only the admin)
      ansible.builtin.copy:
        dest: /etc/ssh/sshd_config.d/05-uidmove.conf
        content: "AllowUsers uidmove\n"
        mode: "0644"
    - name: Check and reload sshd (open sessions stay up)
      ansible.builtin.shell: sshd -t && systemctl reload ssh
      changed_when: true
    - name: Close Ansible's kept-open connection as the admin
      ansible.builtin.meta: reset_connection
- name: 2. Move the admin user, logged in as the temporary one
  hosts: all
  become: true
  remote_user: uidmove
  vars:
    admin_user: "{{ lookup('config', 'DEFAULT_REMOTE_USER') }}"
    new_id: 2000
  tasks:
    - name: End the admin's login sessions (nothing else is killed)
      ansible.builtin.command: loginctl terminate-user {{ admin_user }}
      register: term
      changed_when: term.rc == 0
      failed_when: false
    - name: Wait until no process runs as the admin
      ansible.builtin.command: pgrep -u {{ admin_user }}
      register: left
      until: left.rc == 1
      retries: 15
      delay: 2
      changed_when: false
      failed_when: false
    - name: Stop if something other than a login still runs as the admin's uid
      ansible.builtin.shell: ps -o pid,user,args -u {{ admin_user }}
      register: who
      changed_when: false
      failed_when: true
      when: left.rc != 1
    - name: New gid
      ansible.builtin.group:
        name: "{{ admin_user }}"
        gid: "{{ new_id }}"
    - name: New uid (usermod re-owns the home folder)
      ansible.builtin.user:
        name: "{{ admin_user }}"
        uid: "{{ new_id }}"
        group: "{{ admin_user }}"
    - name: Files in the home folder still in the old group
      ansible.builtin.command: find /home/{{ admin_user }} -xdev -gid 1000 -exec chgrp -h {{ admin_user }} {} +
      changed_when: false
    - name: Close Ansible's kept-open connection as the temporary user
      ansible.builtin.meta: reset_connection
- name: 3. Back as the admin, remove the temporary user
  hosts: all
  become: true
  tasks:
    - name: No more passwordless sudo, and no SSH for the temporary user
      ansible.builtin.file:
        path: "{{ item }}"
        state: absent
      loop:
        - /etc/sudoers.d/uidmove
        - /etc/ssh/sshd_config.d/05-uidmove.conf
    - name: Check and reload sshd
      ansible.builtin.shell: sshd -t && systemctl reload ssh
      changed_when: true
    - name: Wait until no process runs as the temporary user
      ansible.builtin.command: pgrep -u uidmove
      register: left
      until: left.rc == 1
      retries: 15
      delay: 2
      changed_when: false
      failed_when: left.rc != 1
    - name: Remove the temporary user and its home
      ansible.builtin.user:
        name: uidmove
        state: absent
        remove: true
    - name: Show the result
      ansible.builtin.command: id
      become: false
      register: who
      changed_when: false
    - ansible.builtin.debug:
        msg: "{{ who.stdout }}"