You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
65 lines
1.8 KiB
65 lines
1.8 KiB
#
|
|
# Task: Create User
|
|
#
|
|
# - create new User
|
|
# - optional input ip for remote access
|
|
# - remote ip will also add to ufw
|
|
#
|
|
|
|
- name: Input IP
|
|
pause:
|
|
prompt: "Remote IP?"
|
|
register: remote_ip
|
|
|
|
- name: Input Dbname
|
|
pause:
|
|
prompt: "Dbname?"
|
|
register: mariadb_dbname
|
|
|
|
#
|
|
# create username
|
|
#
|
|
- name: create username
|
|
set_fact:
|
|
mariadb_username: "user{{ lookup('community.general.random_string', length=16, upper=false, special=false) }}"
|
|
|
|
#
|
|
#
|
|
#
|
|
- name: create password
|
|
set_fact:
|
|
mariadb_password: "{{ lookup('ansible.builtin.password', '~/' + mariadb_username + '.txt', length=24, chars=['ascii_lowercase', 'digits']) }}"
|
|
|
|
#
|
|
# create user for localhast
|
|
#
|
|
- name: create user
|
|
community.mysql.mysql_query:
|
|
login_db: "mysql"
|
|
login_unix_socket: "{{ mariadb_socket }}"
|
|
query:
|
|
- CREATE USER {{ mariadb_username }}@'localhost' IDENTIFIED BY '{{ mariadb_password }}'
|
|
- GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER,DROP ON {{ mariadb_dbname.user_input }}.* TO {{ mariadb_username }}@localhost
|
|
|
|
#
|
|
# create user for remote ip
|
|
#
|
|
- name: create user for remote
|
|
community.mysql.mysql_query:
|
|
login_db: "mysql"
|
|
login_unix_socket: "{{ mariadb_socket }}"
|
|
query:
|
|
- CREATE USER {{ mariadb_username }}@'{{ remote_ip.user_input }}' IDENTIFIED BY '{{ mariadb_password }}' REQUIRE SSL
|
|
- GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER,DROP ON {{ mariadb_dbname.user_input }}.* TO {{ mariadb_username }}@'{{ remote_ip.user_input }}' REQUIRE SSL
|
|
when: remote_ip.user_input | regex_search('^[0-9]+.[0-9]+.[0-9]+.[0-9]+$')
|
|
|
|
#
|
|
# add rule in ufw for remote ip
|
|
#
|
|
- name: Allow IP for remote access
|
|
ufw:
|
|
rule: allow
|
|
from_ip: "{{ remote_ip.user_input }}"
|
|
port: 3306
|
|
when: remote_ip.user_input | regex_search('^[0-9]+.[0-9]+.[0-9]+.[0-9]+$')
|