457db3ced2
Adds the apt_repository / apt steps that pull authforge-daemon, -pam, and -cli (with -gui gated behind authforge_install_gui), the template step that renders /etc/authforge/policy.d/90-fleet.conf and notifies the restart handler, and a loop that calls `authforgectl pending set` for each entry in authforge_pending_users. The template emits TOML that round-trips through tomllib for both the empty-stacks default and a populated multi-stack config. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
53 lines
1.2 KiB
YAML
53 lines
1.2 KiB
YAML
---
|
|
- name: Add the AuthForge PPA
|
|
ansible.builtin.apt_repository:
|
|
repo: "{{ authforge_ppa }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Install AuthForge headless components
|
|
ansible.builtin.apt:
|
|
name:
|
|
- authforge-daemon
|
|
- authforge-pam
|
|
- authforge-cli
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Install AuthForge GUI (optional)
|
|
ansible.builtin.apt:
|
|
name: authforge-gui
|
|
state: present
|
|
when: authforge_install_gui | bool
|
|
|
|
- name: Ensure /etc/authforge/policy.d exists
|
|
ansible.builtin.file:
|
|
path: /etc/authforge/policy.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Render fleet policy file
|
|
ansible.builtin.template:
|
|
src: policy.conf.j2
|
|
dest: /etc/authforge/policy.d/90-fleet.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart authforge-daemon
|
|
|
|
- name: Mark users as pending-enrollment
|
|
ansible.builtin.command:
|
|
argv:
|
|
- authforgectl
|
|
- pending
|
|
- set
|
|
- "{{ item.user }}"
|
|
- --methods
|
|
- "{{ item.methods | join(',') }}"
|
|
loop: "{{ authforge_pending_users }}"
|
|
loop_control:
|
|
label: "{{ item.user }}"
|
|
changed_when: true
|