fix(wg): correct check for existing private key

Registering output of ‹ansible.builtin.stat› generates an object
containing ‹stat› member itself.

Signed-off-by: Matej Focko <me@mfocko.xyz>

group_vars/servers/vars

@@ -1,5 +1,8 @@
 certbot_email: "{{ vault_certbot_email }}"
 
+cockpit_2fa: true
+cockpit_has_reverse_proxy: true
+
 host_fqdn: "{{ vault_host_fqdn }}"
 
 porkbun_apikey: "{{ vault_porkbun_apikey }}"

playbooks/bootstrap.yml

@@ -10,7 +10,7 @@
 
     - role: os_el
       become: true
-      when: ansible_distribution in [ "AlmaLinux", "CentOS" ]
+      when: ansible_distribution in [ "AlmaLinux", "CentOS", "Rocky" ]
 
     # Upgrade all packages and install the basic-bitch ones
     - role: base_system

roles/base_system/tasks/upgrade.yml

@@ -4,16 +4,16 @@
     name: "*"
     state: latest
     update_cache: true
-  when: ansible_distribution in [ "Debian", "Ubuntu" ]
+  when: ansible_facts.pkg_mgr == "apt"
 
 - name: Upgrade all packages with ‹dnf›
   ansible.builtin.dnf:
     name: "*"
     state: latest
-  when: ansible_distribution in [ "AlmaLinux", "CentOS", "Fedora" ]
+  when: ansible_facts.pkg_mgr.startswith("dnf")
 
 - name: Upgrade all packages with ‹zypper›
   community.general.zypper:
     name: "*"
     state: latest
-  when: "'openSUSE' in ansible_distribution"
+  when: ansible_facts.pkg_mgr == "zypper"

roles/cockpit/defaults/main.yml

@@ -3,3 +3,9 @@
 # reverse proxy (adjusts the origin, so that the Cockpit doesn't drop sessions,
 # and checks for SSL/TLS connections)
 cockpit_has_reverse_proxy: false
+
+# Boolean variable that denotes whether to install dependencies for 2FA auth
+# to Cockpit (Google Authenticator and QR encoding utilities for enrolling the
+# OTP), also installs the rule to the ‹pam.d› so that the 2FA is required for
+# logging in to the Cockpit.
+cockpit_2fa: false

roles/cockpit/tasks/install.yml

@@ -3,3 +3,11 @@
   ansible.builtin.package:
     name: cockpit
     state: present
+
+- name: Install deps for 2FA in Cockpit
+  ansible.builtin.package:
+    name:
+      - google-authenticator
+      - qrencode-libs
+    state: present
+  when: cockpit_2fa

roles/cockpit/tasks/main.yml

@@ -12,6 +12,16 @@
     group: root
   when: cockpit_has_reverse_proxy
 
+- name: Require 2FA for logging into the Cockpit
+  ansible.builtin.lineinfile:
+    line: auth required pam_google_authenticator.so nullok
+    path: /etc/pam.d/cockpit
+    create: true
+    mode: 0644
+    owner: root
+    group: root
+  when: cockpit_2fa
+
 - name: Enable cockpit
   ansible.builtin.service:
     name: "cockpit.socket"

roles/editor_helix/tasks/install_Rocky.yml

@@ -0,0 +1 @@
+install_fedora-family.yml

roles/editor_helix/tasks/install_fedora-family.yml

@@ -1,11 +1,4 @@
 ---
-- name: Enable the Copr
-  community.general.copr:
-    name: varlad/helix
-    state: enabled
-  when: ansible_distribution not in ("AlmaLinux")
-  become: true
-
 - name: Install the Helix
   ansible.builtin.package:
     name: helix

roles/editor_vscode/files/code-url-handler.desktop

@@ -1,12 +0,0 @@
-[Desktop Entry]
-Name=Visual Studio Code - URL Handler
-Comment=Code Editing. Redefined.
-GenericName=Text Editor
-Exec=/opt/VSCode-linux-x64/bin/code-insiders --no-sandbox --open-url %U
-Icon=/opt/VSCode-linux-x64/resources/app/resources/linux/code.png
-Type=Application
-NoDisplay=true
-StartupNotify=true
-Categories=Utility;TextEditor;Development;IDE;
-MimeType=x-scheme-handler/vscode-insiders;
-Keywords=vscode;

roles/editor_vscode/files/code.desktop

@@ -1,18 +0,0 @@
-[Desktop Entry]
-Name=Visual Studio Code Insiders
-Comment=Code Editing. Refined.
-GenericName=Text Editor
-Exec=/opt/VSCode-linux-x64/bin/code-insiders --no-sandbox --unity-launch %F
-Icon=/opt/VSCode-linux-x64/resources/app/resources/linux/code.png
-Type=Application
-StartupNotify=false
-StartupWMClass=code - insiders
-Categories=Utility;TextEditor;Development;IDE;
-MimeType=text/plain;inode/directory;
-Actions=new-empty-window;
-Keywords=vscode;
-
-[Desktop Action new-empty-window]
-Name=New Empty Window
-Exec=/opt/VSCode-linux-x64/bin/code-insiders --no-sandbox --new-window %F
-Icon=/opt/VSCode-linux-x64/resources/app/resources/linux/code.png

roles/editor_vscode/files/update.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-
-# for upstream
-URL='https://code.visualstudio.com/sha/download?build=insider&os=linux-x64'
-
-# for local
-# URL='https://maxwell.mfocko.xyz/code-insiders.tar.gz'
-
-# for local over VPN (also use --no-check-certificate)
-# URL='https://172.16.0.2/code-insiders.tar.gz'
-
-echo ">>> Downloading";
-wget $URL -O /tmp/code.tar.gz
-
-echo ">>> Removing and extracting";
-rm -rf /opt/VSCode-linux-x64
-tar xvaf /tmp/code.tar.gz -C /opt/
-
-# Check for binaries
-if ! [ -x /usr/local/bin/code-insiders ]; then
-	echo ">>> Linking binaries";
-	ln -s /opt/VSCode-linux-x64/bin/code-insiders /usr/local/bin/
-	ln -s /opt/VSCode-linux-x64/bin/code-insiders /usr/local/bin/code
-fi
-
-# Check for *.desktop
-if ! ls /usr/share/applications | grep visual-studio-code; then
-	echo ">>> Installing desktop files";
-	PATH_TO_APPS=/home/mfocko/.local/share/visual-studio-code-insiders
-	sudo cp $PATH_TO_APPS{,-url-handler}.desktop /usr/share/applications/;
-fi

roles/editor_vscode/tasks/install_AlmaLinux.yml

@@ -0,0 +1 @@
+install_rhel.yml

roles/editor_vscode/tasks/install_CentOS.yml

@@ -0,0 +1 @@
+install_rhel.yml

roles/editor_vscode/tasks/install_Fedora.yml

@@ -0,0 +1 @@
+install_rhel.yml

roles/editor_vscode/tasks/install_Rocky.yml

@@ -0,0 +1 @@
+install_rhel.yml

roles/editor_vscode/tasks/install_rhel.yml

@@ -0,0 +1,12 @@
+---
+- name: Resolve URL to the VSCode RPM
+  ansible.builtin.uri:
+    url: https://code.visualstudio.com/sha/download?build=insider&os=linux-rpm-x64
+  register: _vscode_rpm_response
+
+- name: Install VSCode via RPM
+  ansible.builtin.dnf:
+    name: "{{ _vscode_rpm_response.url }}"
+    disable_gpg_check: true
+    state: present
+  become: true

roles/editor_vscode/tasks/main.yml

@@ -1,28 +1,13 @@
 ---
+- name: Install VSCode
+  ansible.builtin.include_tasks: "install_{{ ansible_distribution }}.yml"
+  tags: install
+
 - name: Create directories for VSCode
   ansible.builtin.file:
-    path: "{{ item }}"
+    path: "$HOME/.config/Code - Insiders/User"
     state: directory
     mode: 0740
-  loop:
-    - ~/.local/bin
-    - ~/.local/share
-    - "$HOME/.config/Code - Insiders/User"
-
-- name: Install VSCode script
-  ansible.builtin.copy:
-    src: files/update.sh
-    dest: ~/.local/bin/code-update.sh
-    mode: 0640
-
-- name: Create app info for VSCode
-  ansible.builtin.copy:
-    src: files/code{{ item }}.desktop
-    dest: ~/.local/share/applications/visual-studio-code-insiders{{ item }}.desktop
-    mode: 0640
-  loop:
-    - ""
-    - "-url-handler"
 
 - name: Install VSCode configuration
   ansible.builtin.copy:
@@ -32,11 +17,3 @@
   loop:
     - settings
     - keybindings
-
-- name: Install VSCode
-  ansible.builtin.command:
-    cmd: bash /home/{{ target_user }}/.local/bin/code-update.sh
-    creates: /opt/VSCode-linux-x64
-  become: true
-  when: false
-  tags: install

roles/secrets_hcv/tasks/install_Rocky.yml

@@ -0,0 +1 @@
+install_el.yml

roles/secrets_hcv/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: Install HC Vault via package manager
-  when: ansible_distribution in [ "AlmaLinux", "CentOS", "Fedora", "Ubuntu"]
+  when: ansible_distribution in [ "AlmaLinux", "CentOS", "Fedora", "Rocky", "Ubuntu"]
   tags: install
   block:
     - name: Enable repository

roles/shell_zsh/tasks/install.yml

@@ -34,4 +34,4 @@
     name: yad
     state: present
   become: true
-  when: 'ansible_distribution not in [ "AlmaLinux" ] and "openSUSE" not in ansible_distribution'
+  when: 'ansible_distribution not in [ "AlmaLinux", "Rocky" ] and "openSUSE" not in ansible_distribution'

roles/ssh_server/tasks/main.yml

@@ -55,4 +55,4 @@
 
 - name: Set trusted CA
   ansible.builtin.include_tasks: trusted_ca.yml
-  when: sshd_auth_trusted_ca
+  when: ssh_server_auth_trusted_ca

roles/wg/tasks/generate_keypair.yml

@@ -16,5 +16,5 @@
 
 - name: Set key/pair facts
   ansible.builtin.set_fact:
-    wg_private_key: _generated_private_key.stdout
+    wg_private_key: "{{ _generated_private_key.stdout }}"
-    wg_public_key: _derived_public_key.stdout
+    wg_public_key: "{{ _derived_public_key.stdout }}"

roles/wg/tasks/main.yml

@@ -6,11 +6,11 @@
 - name: Check for existence of private key
   ansible.builtin.stat:
     path: /etc/wireguard/private.key
-  register: _private_key_stat
+  register: _private_key
 
 - name: Generate keypair
   ansible.builtin.include_tasks: tasks/generate_keypair.yml
-  when: not _private_key_stat.exists
+  when: not _private_key.stat.exists
 
 - name: Save private key
   ansible.builtin.template:
@@ -21,7 +21,7 @@
     mode: 0700
   vars:
     key: "{{ wg_private_key }}"
-  when: not _private_key_stat.exists
+  when: not _private_key.stat.exists
 
 - name: Save public key
   ansible.builtin.template:
@@ -32,7 +32,7 @@
     mode: 0700
   vars:
     key: "{{ wg_public_key }}"
-  when: not _private_key_stat.exists
+  when: not _private_key.stat.exists
 
 - name: Set dns_command for co-openSUSE
   ansible.builtin.set_fact:

roles/yubikey_pam/tasks/install.yml

@@ -3,7 +3,7 @@
   ansible.builtin.package:
     name: pam_yubico
     state: present
-  when: ansible_distribution in [ "AlmaLinux", "CentOS", "Fedora" ]
+  when: ansible_distribution in [ "AlmaLinux", "CentOS", "Fedora", "Rocky" ]
 
 - name: Enable PPA on Ubuntu
   ansible.builtin.apt_repository: