Migrate the users role

roles/users/molecule/default/converge.yml

@@ -0,0 +1,10 @@
+---
+- name: Converge
+  hosts: all
+
+  roles:
+    - role: genlab.users
+      manifest_path: "users.yml"
+      common_memory_max: "500M"
+      common_swap_max: "2G"
+      common_cpu_quota: "100%"

roles/users/molecule/default/molecule.yml

@@ -0,0 +1,27 @@
+---
+dependency:
+  name: galaxy
+
+driver:
+  name: docker
+
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2404}-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+
+provisioner:
+  name: ansible
+
+verifier:
+  name: ansible
+
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

roles/users/molecule/default/user0.keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMh9Y+wR4LH8lWJjJXqHn76kSoTRujkab+PYwD3IReFh user0@hostname

roles/users/molecule/default/users.yml

@@ -0,0 +1,22 @@
+---
+users:
+  - name: "user0"
+    uid: 1001
+    gid: 1004
+    full_name: "User Zero"
+    state: "present"
+    groups: [sudo]
+    create_home: true
+    home_root: "/tmp/someplace"
+    shell: "/bin/bash"
+    pubkeys_file: "user0.keys"
+
+  - name: "user1"
+    uid: 1002
+    full_name: "User One"
+    state: "present"
+    groups: []
+    create_home: true
+    shell: "/bin/sh"
+    expires: "2024-07-23 12:00:00"
+    generate_ssh_key: true

roles/users/molecule/default/verify.yml

@@ -0,0 +1,64 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: true
+  any_errors_fatal: true
+
+  tasks:
+    - name: "Get user info from /etc/passwd"
+      register: etc_passwd
+      changed_when: false
+      ansible.builtin.shell:
+        cmd: set -o pipefail; cat /etc/passwd | grep user
+        executable: /bin/bash
+
+    - name: "Get user info from /etc/shadow"
+      register: etc_shadow
+      changed_when: false
+      ansible.builtin.shell:
+        cmd: set -o pipefail; cat /etc/shadow | grep user
+        executable: /bin/bash
+
+    # using a hack since here the date of last password change == date of account creation
+    - name: "Verify expected account configuration"
+      vars:
+        expected_shadow:
+          - "user0:!:{{ (ansible_date_time.epoch | int) // 86400 }}:0:99999:7:::"
+          - "user1:!:{{ (ansible_date_time.epoch | int) // 86400 }}:0:99999:7::19927:"
+        expected_passwd:
+          - "user0:x:1001:1004:User Zero:/tmp/someplace/user0:/bin/bash"
+          - "user1:x:1002:1002:User One:/home/user1:/bin/sh"
+      ansible.builtin.assert:
+        that:
+          - etc_passwd.stdout_lines == expected_passwd
+          - etc_shadow.stdout_lines == expected_shadow
+
+    - name: "Get SSH key contents for user1"
+      register: user1_ssh_key
+      changed_when: false
+      ansible.builtin.command:
+        cmd: cat /home/user1/.ssh/id_ed25519.pub
+
+    - name: "Verify the SSH key contents for user1"
+      ansible.builtin.assert:
+        that: "'user1@ubuntu' in user1_ssh_key.stdout"
+
+    - name: "Get the user slice drop-in for user0"
+      register: user0_slice_dropin
+      changed_when: false
+      ansible.builtin.command:
+        cmd: cat /etc/systemd/system/user-1001.slice.d/50-limits.conf
+
+    - name: "Verify drop-in contens"
+      vars:
+        expected:
+          - "[Slice]"
+          - "MemoryAccounting=1"
+          - "MemoryMax=500M"
+          - "MemorySwapMax=2G"
+          - "CPUAccounting=1"
+          - "CPUQuota=100%"
+      ansible.builtin.assert:
+        that: "user0_slice_dropin.stdout_lines == expected"
+        success_msg: "Got the expected limits slice drop-in"
+        fail_msg: "Unexpected limits slice drop-in contents"

roles/users/molecule/users_from_var/converge.yml

@@ -0,0 +1,31 @@
+---
+- name: Converge
+  hosts: all
+
+  roles:
+    - role: genlab.users
+      manifest_path: "some-none-existent-file"  # the 'users' variable is supposed to take precedence
+      common_memory_max: "500M"
+      common_swap_max: "2G"
+      common_cpu_quota: "100%"
+      users:
+        - name: "user0"
+          uid: 1001
+          gid: 1004
+          full_name: "User Zero"
+          state: "present"
+          groups: [sudo]
+          create_home: true
+          home_root: "/tmp/someplace"
+          shell: "/bin/bash"
+          pubkeys_file: "user0.keys"
+
+        - name: "user1"
+          uid: 1002
+          full_name: "User One"
+          state: "present"
+          groups: []
+          create_home: true
+          shell: "/bin/sh"
+          expires: "2024-07-23 12:00:00"
+          generate_ssh_key: true

roles/users/molecule/users_from_var/molecule.yml

@@ -0,0 +1,27 @@
+---
+dependency:
+  name: galaxy
+
+driver:
+  name: docker
+
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2404}-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+
+provisioner:
+  name: ansible
+
+verifier:
+  name: ansible
+
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

roles/users/molecule/users_from_var/user0.keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMh9Y+wR4LH8lWJjJXqHn76kSoTRujkab+PYwD3IReFh user0@hostname

roles/users/molecule/users_from_var/verify.yml

@@ -0,0 +1,64 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: true
+  any_errors_fatal: true
+
+  tasks:
+    - name: "Get user info from /etc/passwd"
+      register: etc_passwd
+      changed_when: false
+      ansible.builtin.shell:
+        cmd: set -o pipefail; cat /etc/passwd | grep user
+        executable: /bin/bash
+
+    - name: "Get user info from /etc/shadow"
+      register: etc_shadow
+      changed_when: false
+      ansible.builtin.shell:
+        cmd: set -o pipefail; cat /etc/shadow | grep user
+        executable: /bin/bash
+
+    # using a hack since here the date of last password change == date of account creation
+    - name: "Verify expected account configuration"
+      vars:
+        expected_shadow:
+          - "user0:!:{{ (ansible_date_time.epoch | int) // 86400 }}:0:99999:7:::"
+          - "user1:!:{{ (ansible_date_time.epoch | int) // 86400 }}:0:99999:7::19927:"
+        expected_passwd:
+          - "user0:x:1001:1004:User Zero:/tmp/someplace/user0:/bin/bash"
+          - "user1:x:1002:1002:User One:/home/user1:/bin/sh"
+      ansible.builtin.assert:
+        that:
+          - etc_passwd.stdout_lines == expected_passwd
+          - etc_shadow.stdout_lines == expected_shadow
+
+    - name: "Get SSH key contents for user1"
+      register: user1_ssh_key
+      changed_when: false
+      ansible.builtin.command:
+        cmd: cat /home/user1/.ssh/id_ed25519.pub
+
+    - name: "Verify the SSH key contents for user1"
+      ansible.builtin.assert:
+        that: "'user1@ubuntu' in user1_ssh_key.stdout"
+
+    - name: "Get the user slice drop-in for user0"
+      register: user0_slice_dropin
+      changed_when: false
+      ansible.builtin.command:
+        cmd: cat /etc/systemd/system/user-1001.slice.d/50-limits.conf
+
+    - name: "Verify drop-in contens"
+      vars:
+        expected:
+          - "[Slice]"
+          - "MemoryAccounting=1"
+          - "MemoryMax=500M"
+          - "MemorySwapMax=2G"
+          - "CPUAccounting=1"
+          - "CPUQuota=100%"
+      ansible.builtin.assert:
+        that: "user0_slice_dropin.stdout_lines == expected"
+        success_msg: "Got the expected limits slice drop-in"
+        fail_msg: "Unexpected limits slice drop-in contents"