Revert to single forge user, improve

1 files changed, 70 insertions, 91 deletions

diff --git a/roles/jails/22_forge/tasks/main.yml b/roles/jails/22_forge/tasks/main.yml
index 24fe362..92a29c8 100644
--- a/roles/jails/22_forge/tasks/main.yml
+++ b/roles/jails/22_forge/tasks/main.yml
@@ -2,133 +2,111 @@
     name: jail
     tasks_from: jail_setup
 
-# --- Shared git-shell-commands ---
+# --- git user ---
 
-- name: Create /usr/local/libexec/git-shell-commands directory
-  file:
-    path: /var/db/repos/git-shell-commands
-    state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Deploy git-shell-commands
-  copy:
-    src: "{{ jail_role_dir }}/files/git-shell-commands/{{ item }}"
-    dest: "/var/db/repos/git-shell-commands/{{ item }}"
-    owner: root
-    group: wheel
-    mode: "0755"
-  loop:
-    - help
-    - new
-    - ls
-    - delete
-    - rename
-    - describe
-    - mirror
-
-# --- Forge users ---
-
-- name: Create forge user groups
+- name: Create git group
   group:
-    name: "{{ item.name }}"
-    gid: "{{ item.uid }}"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
+    name: git
+    gid: 1000
 
-- name: Create forge users
+- name: Create git user
   user:
-    name: "{{ item.name }}"
-    uid: "{{ item.uid }}"
-    group: "{{ item.name }}"
+    name: git
+    uid: 1000
+    group: git
     home: /var/db/repos
     shell: /usr/local/bin/git-shell
+    comment: "Git Server"
     create_home: false
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
 
-- name: Create per-user config directories
+- name: Create .ssh directory for git user
   file:
-    path: "/var/db/forge-config/{{ item.name }}"
+    path: /var/db/repos/.ssh
     state: directory
-    owner: "{{ item.name }}"
-    group: "{{ item.name }}"
+    owner: git
+    group: git
     mode: "0700"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
 
-- name: Create .ssh directories for forge users
-  file:
-    path: "/var/db/forge-config/{{ item.name }}/.ssh"
-    state: directory
-    owner: "{{ item.name }}"
-    group: "{{ item.name }}"
-    mode: "0700"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
-
-- name: Deploy authorized_keys for forge users
+- name: Deploy authorized_keys
   copy:
-    content: "{{ item.authorized_keys }}\n"
-    dest: "/var/db/forge-config/{{ item.name }}/.ssh/authorized_keys"
-    owner: "{{ item.name }}"
-    group: "{{ item.name }}"
+    content: "{{ forge_authorized_keys }}\n"
+    dest: /var/db/repos/.ssh/authorized_keys
+    owner: git
+    group: git
     mode: "0600"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
 
-- name: Deploy gitconfig for primary forge user (jan)
+- name: Deploy gitconfig for git user
   copy:
     content: |
       [init]
           defaultBranch = main
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.gitconfig"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    dest: /var/db/repos/.gitconfig
+    owner: git
+    group: git
     mode: "0644"
 
+- name: Deploy SSH config for git user
+  copy:
+    content: |
+      Host *
+          IdentityFile ~/.ssh/forge_deploy
+          IdentitiesOnly yes
+          StrictHostKeyChecking=accept-new
+    dest: /var/db/repos/.ssh/config
+    owner: git
+    group: git
+    mode: "0600"
+
 - name: Deploy forge deploy private key
   copy:
     content: "{{ forge_deploy_key.private }}"
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    dest: /var/db/repos/.ssh/forge_deploy
+    owner: git
+    group: git
     mode: "0600"
 
 - name: Deploy forge deploy public key
   copy:
     content: "{{ forge_deploy_key.public }}"
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy.pub"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    dest: /var/db/repos/.ssh/forge_deploy.pub
+    owner: git
+    group: git
     mode: "0644"
 
-- name: Deploy SSH config for primary forge user
+# --- git-shell-commands ---
+
+- name: Create git-shell-commands directory
+  file:
+    path: /var/db/repos/git-shell-commands
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy git-shell-commands
   copy:
-    content: |
-      Host *
-          IdentityFile /var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy
-          IdentitiesOnly yes
-          StrictHostKeyChecking=accept-new
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/config"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
-    mode: "0600"
+    src: "{{ jail_role_dir }}/files/git-shell-commands/{{ item }}"
+    dest: "/var/db/repos/git-shell-commands/{{ item }}"
+    owner: root
+    group: wheel
+    mode: "0755"
+  loop:
+    - help
+    - new
+    - ls
+    - delete
+    - rename
+    - describe
+    - mirror
 
-# --- Git mirrors ---
+# --- git mirrors ---
 
 - name: Create git-mirrors log file
   file:
     path: /var/log/git-mirrors.log
     state: touch
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    owner: git
+    group: git
     mode: "0644"
 
 - name: Deploy git-mirrors script
@@ -139,13 +117,13 @@
     group: wheel
     mode: "0755"
 
-- name: Deploy crontab for primary forge user
+- name: Deploy crontab for git user
   copy:
     content: |
       SHELL=/bin/sh
       PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
       0 * * * * /usr/local/bin/git-mirrors
-    dest: "/var/cron/tabs/{{ forge_users[0].name }}"
+    dest: /var/cron/tabs/git
     owner: root
     group: wheel
     mode: "0600"
@@ -251,6 +229,7 @@
     group: wheel
     mode: "0644"
   notify: Restart sshd
+
 - import_role:
     name: jail
     tasks_from: jail_launch