idmBuild.yaml

---
# Windows section
- name: Configure Windows pt 1
  hosts: win
  gather_facts: true
  become_method: runas
  become_user: Administrator
  become: false
  roles:
    - role: winPromote # Converts Windows server into domain controller and adds users and groups
      state: present
  tags: win1
- name: Configure Windows pt 2
  hosts: win
  become_method: runas
  become_user: Administrator
  become: false
  roles:
    - role: win_delegate # Delegates sub-domain to IdM
      state: present
  tags: win2
## Need to choose which method to update systems with.
- name: Subscribe systems to RH CDN
  hosts: ipaserver:ipareplicas
  become: true
  roles:
    - role: subscribe-cdn # Registers RHEL systems to the Red Hat CDN
  tags:
    - cdn
    - never
- name: Subscribe systems to local satellite
  hosts: all:!win
  become: true
  tasks:
  - name: Using katello-ca 
    ansible.builtin.import_tasks: roles/subscribe-sat/tasks/katello.yml
    tags:
      - katello
      - never
  - name: Using runtime generated registration command
    ansible.builtin.import_tasks: roles/subscribe-sat/tasks/sat616-2.yml
    tags:
      - rtgrc
      - never
  - name: Using pre-generated registration command
    ansible.builtin.import_tasks: roles/subscribe-sat/tasks/sat616-2.yml
    tags: 
      - pgrc
      # - never
# OS section
- name: Add local linux users
  hosts: all:!win
  gather_facts: true
  roles:
    - role: local_users # Adds additional users to local RHEL systems
  tags: locUsers
- name: Configure hosts file
  hosts: all:!win
  roles:
    - role: update_hosts # Adds local hostname to /etc/hosts file
  tags: confHosts
- name: Update nameserver entry on ipareplcas and ipaclients
  hosts: ipareplicas:ipaclients
  roles:
    - role: rhel-system-roles.network # Changes IdM clients DNS to point to IdM server for resolution
  tags: network
- name: Update Crypto for AD-Trust
  hosts: ipaserver:ipareplicas
  become: true
  roles:
    - role: redhat.rhel_system_roles.crypto_policies # Updates crypto policy
      vars:
        crypto_policies_policy: "{{ crypto }}"
        crypto_policies_reboot_required: true
  tags:
    - crypto
    - never
- name: Installs the IdM server
  hosts: ipaserver
  roles:
    - role: redhat.rhel_idm.ipaserver
  tags: server
- name: Set umask on replicas and clients
  hosts: ipareplicas:ipaclients
  become: true
  roles:
    - role: umask22
  tags:
    - stig
    - never
- name: Turn IdM DNS PTR Sync on
  hosts: ipaserver
  roles:
    - role: idm-dns_ptr
  tags: server
- name: Installs the IdM replicas
  hosts: ipareplicas
  roles:
    - role: redhat.rhel_idm.ipareplica
  tags: replicas
- name: Installs the IdM clients
  hosts: ipaclients,ipareplicas
  roles:
    - role: redhat.rhel_idm.ipaclient
  tags: clients
- name: Revert umask back on replicas and clients
  hosts: ipareplicas:ipaclientss
  become: true
  roles:
    - role: umask77
  tags:
    - stig
    - never
# IdM configuration
- name: Sets up the AD trust.
  hosts: ipaserver
  roles:
    - role: idm-dns_ad_setup
  tags: adtrust
- name: Setup IDP
  hosts: ipaserver
  roles:
    - role: idm-idp
  tags:
    - idp
- name: Create IdM users
  hosts: ipaserver
  roles:
    - role: idm-users
  tags: idmUsers
- name: Create external group for AD Users/Groups
  hosts: ipaserver
  roles:
    - role: idm-groups
  tags: idmGrps
- name: Set default shell
  hosts: ipaserver
  roles:
    - role: idm-defaults
  tags: defaults
- name: Create client host group
  hosts: ipaserver
  become: false
  roles:
    - role: idm-hostgroup
  tags: hostGrp
- name: Create HBAC Rules
  hosts: ipaserver
  become: false
  roles:
    - role: idm-hbac
  tags: hbac
- name: Create IdM SUDO rules
  hosts: ipaserver
  become: false
  roles:
    - role: idm-sudo
  tags: sudo