mq-ansible
mq-ansible copied to clipboard
Remove `passlib` as a dependency
passlib
was an annoying thing for me to install.
It should just be pip install but when I ran this, I realised Ansible, VS Code, and the command python
were all pointing to different versions/envs of python.
To avoid headaches like this, I think it's better to include dependency installation (if not installed) as part of the automation.
I've had a look at where passlib
is used and I don't think it's necessary.
Consider the code:
- name: Add the user 'app' with a specific UID
become: true
vars:
apppassword: Passw0rd
user:
name: app
password: "{{ 'apppassword' | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) }}"
uid: "{{ app_uid }}"
group: mqclient
A few thoughts:
-
'apppassword'
!=apppassword
, one is a var name, the other a literal string.apppassword
is never used,'apppassword'
is. This means this default password has been named three times.'Passw0rd'
!='apppassword'
!=apppassword
- There is no point hashing a default password hardcoded into the repository, I think it's obvious it's not a secure/good password.
- A simpler solution is surely more amenable to varied users who likely have different security strategies.