nfs.yml

---
- hosts: nfs_server
  remote_user: root

  tasks:
# set up NFS
    - name: Ensure NFS utilities are installed.
      apt: 
        pkg:
        - nfs-common
        - nfs-kernel-server
        state: present
        update_cache: yes

    - name: Create mountable dir
      file: path=/share state=directory mode=777 owner=root group=root

    - name: make sure the mount drive has a filesystem
      filesystem: fstype=ext4 dev=/dev/sdb1

    - name: set mountpoints
      mount: path=/share src=/dev/sdb1 fstype=ext4 opts=rw,sync state=mounted

    - name: Create nfs4 mountable dir
      file: path=/srv/nfs4/umshared state=directory mode=777 owner=root group=root

    - name: set mount to nfs4
      mount: path=/srv/nfs4/umshared src=/share opts=bind state=mounted fstype=ext4 

    - name: copy /etc/exports
      template: src=exports.j2 dest=/etc/exports owner=root group=root

    - name: restart nfs server
      service: name=nfs-kernel-server state=restarted

    - name: open firewall port for nfs
      shell: ufw allow from 192.168.3.0/24 to any port nfs
      args:
        executable: /bin/bash

# create an admin user
    - name: create hashed password
      command: openssl passwd -1 {{ admin_password }}
      register: result
    
    - set_fact:
        hashed_password: "{{ result.stdout }}"

    - name: create new user
      user:
        name: "{{ admin_username }}"
        password: "{{ hashed_password }}"
        groups: sudo,netdev
        shell: /bin/bash
    
    - name: create ssh key directory
      file:
        path: ssh_keys
        state: directory
      delegate_to: 127.0.0.1
      become: no
    
    - stat:
        path: ssh_keys/id_rsa_{{ admin_username }}.pub
      register: status
      delegate_to: 127.0.0.1
      become: no
    
    - name: create ssh key for  "{{ admin_username }}"
      openssh_keypair:
        path: "ssh_keys/id_rsa_{{ admin_username }}"
        type: rsa
        size: 2048
        state: present
        force: no
      delegate_to: 127.0.0.1
      become: no

    - name: copy ssh key to remote host
      copy:
        src: ssh_keys/id_rsa_{{ admin_username }}.pub
        dest: /home/{{ admin_username }}/.ssh/
    
    - name: add ssh key to remote account
      authorized_key:
        user: "{{ admin_username }}"
        key: "{{ lookup('file', 'ssh_keys/id_rsa_{{ admin_username }}.pub') }}"

# remove root access now we have an admin user
    - name: Disallow password authentication
      lineinfile: dest=/etc/ssh/sshd_config
                  regexp="^PasswordAuthentication"
                  line="PasswordAuthentication no"
                  state=present
      notify: Restart ssh
    
    - name: Disallow root SSH access
      lineinfile: dest=/etc/ssh/sshd_config
                  regexp="^PermitRootLogin"
                  line="PermitRootLogin no"
                  state=present
      notify: Restart ssh
   

  handlers:
  - name: Restart ssh
    service: name=ssh state=restarted