Merge branch windows-ansible:main into main

ansible/roles/win_initial/tasks/initial.yml

@@ -17,9 +17,11 @@
         ansible_password: "{{ vm_password }}"
       run_once: true
       when: password_status == 'finished' 
-    
-    - name: Test password
-      win_ping:
+
+    - name: wait for connention to VM
+      ansible.builtin.wait_for_connection:
+        delay: 10
+        timeout: 600
       any_errors_fatal: true
 
 - name: Set WinRM to delayed startup

ansible/roles/win_study/tasks/os-transfer.yml

@@ -3,6 +3,7 @@
   file:
     path: "{{ item }}"
     state: directory
+    mode: '0750'
   loop: "{{ mft_directories }}"
   when: study_action == 'create'
 

ansible/roles/win_user/tasks/assert.yml

@@ -49,6 +49,15 @@
         quiet: true
       when: user_action == 'disable'
 
+    - name: Check User Info [ENABLE]
+      ansible.builtin.assert:
+        that:
+        # - username checked already
+          - study_code is defined # so can be removed from group (WIP)
+          - user_role is defined  # so can be removed from group (WIP)
+        quiet: true
+      when: user_action == 'disable'
+
     - name: Check User Info [MODIFY]
       ansible.builtin.assert:
         that:
@@ -77,6 +86,9 @@
       register: folder
       delegate_to: "{{ os_project }}-{{ win_project }}-fs01"
       failed_when: folder.stat.exists == false
+  when: | 
+    user_action == 'create' or
+    user_action == 'modify'
 
 - name: Verify User
   block:

ansible/roles/win_user/tasks/enable.yml

@@ -0,0 +1,9 @@
+---
+- name: Enable AD user
+  block:
+    - name: Enable user in AD
+      microsoft.ad.user:
+        name: "{{ username }}"
+        path: ou=Project Users,dc={{ win_project }},dc=loc
+        state: present
+        enabled: yes

ansible/roles/win_user/vars/main.yml

@@ -1,4 +1,4 @@
 study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }}
 exporter_group: "{{ study_code }}-exporter"
 
-valid_actions: ["create", "reset", "disable", "modify"]
+valid_actions: ["create", "reset", "disable", "enable", "modify"]

ansible/vars/protected.yml

@@ -69,10 +69,13 @@ remote_ip_rules:
   - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"}
 # File servers
   - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"}
+  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"}
 
 # All Winwdows VMs
+  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"}
   - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}
   - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"}
+  - { direction: "engress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"}
   - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"}
   - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"}
   - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"}

ansible/vars/standard.yml

@@ -42,8 +42,10 @@ remote_ip_rules:
   - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"}
 # File servers
   - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"}
+  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"}
 
 # All Winwdows VMs
+  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"}
   - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"}
   - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.172/32", comment: "WinRM rundeck 2"}
   - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}