From 834e0c21992e2ca7f479e2f8a09e340f757b2119 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Mon, 22 Sep 2025 11:34:06 +0100 Subject: [PATCH] tweaks for new VM creation --- ansible/roles/win_client/tasks/rdgw.yml | 17 +++++++++++++---- .../win_domain_controller/defaults/main.yml | 3 ++- .../roles/win_domain_controller/tasks/setup.yml | 12 ++++++++++-- ansible/roles/win_initial/tasks/initial.yml | 2 +- ansible/roles/win_user/defaults/main.yml | 3 ++- ansible/roles/win_user/tasks/create.yml | 1 + ansible/roles/win_vms/defaults/main.yml | 6 +++++- ansible/vars/common.yml | 2 ++ 8 files changed, 36 insertions(+), 10 deletions(-) diff --git a/ansible/roles/win_client/tasks/rdgw.yml b/ansible/roles/win_client/tasks/rdgw.yml index 7c82ba8..5e91321 100644 --- a/ansible/roles/win_client/tasks/rdgw.yml +++ b/ansible/roles/win_client/tasks/rdgw.yml @@ -7,6 +7,15 @@ state: present tags: guacamole_rdu +- name: Add Docker group to docker-users + ansible.windows.win_group_membership: + name: docker-users + members: + - "{{ win_project}}\\{{ docker_user_group }}" + state: present + ignore_errors: true + tags: docker_access + - name: RD Gateway setup tags: client_rdgw block: @@ -25,7 +34,7 @@ Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server ValueName: fDenyTSConnections ValueData: 0 - PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_username: "{{ domain_administrator }}" PsDscRunAsCredential_password: "{{ ansible_password }}" - name: Registry edit - fSingleSessionPerUser @@ -35,7 +44,7 @@ Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server ValueName: fSingleSessionPerUser ValueData: 1 - PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_username: "{{ domain_administrator }}" PsDscRunAsCredential_password: "{{ ansible_password }}" - name: Registry edit - SecurityLayer @@ -45,7 +54,7 @@ Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server ValueName: SecurityLayer ValueData: 0 - PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_username: "{{ domain_administrator }}" PsDscRunAsCredential_password: "{{ ansible_password }}" - name: Registry edit - UserAuthentication @@ -55,7 +64,7 @@ Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp ValueName: UserAuthentication ValueData: 0 - PsDscRunAsCredential_username: Administrator + PsDscRunAsCredential_username: "{{ domain_administrator }}" PsDscRunAsCredential_password: "{{ ansible_password }}" - name: Enable NetFireWallRule - “Remote Desktop” diff --git a/ansible/roles/win_domain_controller/defaults/main.yml b/ansible/roles/win_domain_controller/defaults/main.yml index 3942fd8..d72d828 100644 --- a/ansible/roles/win_domain_controller/defaults/main.yml +++ b/ansible/roles/win_domain_controller/defaults/main.yml @@ -1 +1,2 @@ -guacamole_user_group: "Guacamole Users" \ No newline at end of file +guacamole_user_group: "Guacamole Users" +docker_user_group: "Docker Users" \ No newline at end of file diff --git a/ansible/roles/win_domain_controller/tasks/setup.yml b/ansible/roles/win_domain_controller/tasks/setup.yml index efd9071..8dde5c5 100644 --- a/ansible/roles/win_domain_controller/tasks/setup.yml +++ b/ansible/roles/win_domain_controller/tasks/setup.yml @@ -56,7 +56,7 @@ - name: Promote DC02 to domain controller microsoft.ad.domain_controller: dns_domain_name: "{{ win_project }}.loc" - domain_admin_user: "Administrator@{{ win_project }}.loc" + domain_admin_user: "{{ domain_administrator }}@{{ win_project }}.loc" domain_admin_password: "{{ ansible_password }}" safe_mode_password: "{{ safemode_password }}" state: domain_controller @@ -70,7 +70,7 @@ - name: Promote DC02 to domain controller microsoft.ad.domain_controller: dns_domain_name: "{{ win_project }}.loc" - domain_admin_user: "Administrator@{{ win_project }}.loc" + domain_admin_user: "{{ domain_administrator }}@{{ win_project }}.loc" domain_admin_password: "{{ ansible_password }}" safe_mode_password: "{{ safemode_password }}" state: domain_controller @@ -131,6 +131,14 @@ path: "cn=Users,dc={{ win_project }},dc=loc" scope: domainlocal category: security + + - name: Create Docker Users group for Docker Desktop access + microsoft.ad.group: + name: "{{ docker_user_group }}" + description: "Allow docker desktop access for docker users" + path: "cn=Users,dc={{ win_project }},dc=loc" + scope: domainlocal + category: security when: inventory_hostname in groups['meta-name_dc01'] diff --git a/ansible/roles/win_initial/tasks/initial.yml b/ansible/roles/win_initial/tasks/initial.yml index 4e5d4c0..0bbcf25 100644 --- a/ansible/roles/win_initial/tasks/initial.yml +++ b/ansible/roles/win_initial/tasks/initial.yml @@ -87,7 +87,7 @@ block: - name: Change Administrator password win_user: - name: Administrator + name: "{{ domain_administrator }}" password: "{{ vm_password }}" - name: Set Password Status diff --git a/ansible/roles/win_user/defaults/main.yml b/ansible/roles/win_user/defaults/main.yml index 663d8e1..e90614d 100644 --- a/ansible/roles/win_user/defaults/main.yml +++ b/ansible/roles/win_user/defaults/main.yml @@ -1,2 +1,3 @@ user_action: create -guacamole_user_group: "Guacamole Users" \ No newline at end of file +guacamole_user_group: "Guacamole Users" +docker_user_group: "Docker Users" \ No newline at end of file diff --git a/ansible/roles/win_user/tasks/create.yml b/ansible/roles/win_user/tasks/create.yml index 0baf29c..1ab1262 100644 --- a/ansible/roles/win_user/tasks/create.yml +++ b/ansible/roles/win_user/tasks/create.yml @@ -12,6 +12,7 @@ add: - "{{ study_code }}" - "{{ guacamole_user_group }}" + - "{{ docker_user_group }}" email: "{{ email }}" attributes: add: diff --git a/ansible/roles/win_vms/defaults/main.yml b/ansible/roles/win_vms/defaults/main.yml index a51c8ba..29a1cf0 100644 --- a/ansible/roles/win_vms/defaults/main.yml +++ b/ansible/roles/win_vms/defaults/main.yml @@ -1 +1,5 @@ -cleanup: false \ No newline at end of file +cleanup: false +state: present +new_wb_quantity: 0 +new_app_quantity: 0 +new_gpu_quantity: 0 \ No newline at end of file diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml index 0fe1802..531c891 100644 --- a/ansible/vars/common.yml +++ b/ansible/vars/common.yml @@ -27,6 +27,8 @@ filetransfer_user: file-transfer filemanager_user: file-manager guacamole_user_group: "Guacamole Users" +docker_user_group: "Docker Users" +domain_administrator: "Administrator" winrm_script_url: http://10.24.3.242/ConfigureRemotingForAnsible.ps1