# roles/rhbase/tasks/admin.yml
#
# Settings regarding the admin user
---
- name: Admin | Make sure users from the wheel group can use sudo
  lineinfile:
    dest: /etc/sudoers.d/wheel
    state: present
    create: true
    regexp: '^%wheel'
    line: '%wheel ALL=(ALL) ALL'
    validate: 'visudo -cf %s'
  tags:
    - rhbase
    - admin

- name: Admin | Set attributes of sudo configuration file for wheel group
  file:
    path: /etc/sudoers.d/wheel
    owner: root
    group: root
    mode: 0440
  tags:
    - rhbase
    - admin

- name: Admin | Make sure only these groups can ssh
  lineinfile:
    dest: /etc/ssh/sshd_config
    state: present
    create: true
    regexp: '^AllowGroups'
    line: "AllowGroups={{ ' '.join(rhbase_ssh_allow_groups) }}"
  notify: restart sshd
  tags:
    - rhbase
    - admin
