adding more comments

playbooks/roles/analytics-server/defaults/main.yml

@@ -66,14 +66,6 @@ as_env_vars:
   ANALYTICS_SERVER_LOG_LEVEL: "{{ AS_LOG_LEVEL }}"
 
 #
-# Used by the included role, automated.
-# See meta/main.yml
-#
-as_automated_rbash_links:
-  - /usr/bin/sudo
-  - /usr/bin/scp
-
-#
 # OS packages
 #
 

playbooks/roles/analytics-server/meta/main.yml

 ---
 dependencies:
   - role: user
-    name: automator
-    sudoers_template: '99-automator-analytics.j2'
-    user_authorized_keys: "{{ AS_AUTOMATOR_AUTHORIZED_KEYS }}"
-    rbash_links: "{{ as_automated_rbash_links }}"
+    user_info:
+    - name: automator
+      sudoers_template: '99-automator-analytics.j2'
+      user_authorized_keys: "{{ AS_AUTOMATOR_AUTHORIZED_KEYS }}"
+    user_rbash_links:
+      - /usr/bin/sudo
+      - /usr/bin/scp
     when: AS_AUTOMATOR_AUTHORIZED_KEYS|length != 0

playbooks/roles/edxapp/meta/main.yml

@@ -7,7 +7,8 @@ dependencies:
     rbenv_ruby_version: "{{ edxapp_ruby_version }}"
   - devpi
   - role: user
-    name: automator
-    sudoers_template: '99-edxapp-manage-cmds.j2'
-    user_authorized_keys: "{{ EDXAPP_AUTOMATOR_AUTHORIZED_KEYS }}"
+    user_info:
+      name: automator
+      sudoers_template: '99-edxapp-manage-cmds.j2'
+      user_authorized_keys: "{{ EDXAPP_AUTOMATOR_AUTHORIZED_KEYS }}"
     when: EDXAPP_AUTOMATOR_AUTHORIZED_KEYS|length != 0

playbooks/roles/user/tasks/main.yml

@@ -35,26 +35,33 @@
 #
 #   - role: user
 #     user_info:
-#       - name: joe
+#       # This restricted user is defined in meta/
+#       # for edxapp, it creates a user that can only
+#       # run manage.py commands
+#       - name: automator
 #         restricted: true
 #         # The sudoers file is optional.
-#         sudoers_template: 'roles/edxapp/templates/etc/sudoers.d/99-automator-edxapp-server.j2'
+#         sudoers_template: '99-edxapp-manage-cmds.j2'
 #         authorized_keys:
 #         - ssh-rsa abcdef...
 #         - ssh-rsa ghiklm...
-
+#
+#       # More users passed to the role, this one is a user
+#       # with full sudo, key fetched from github
 #       - name: frank
 #         github: true
 #         admin: true
 #
+#       # This user is a normal login user without sudo, with
+#       # a couple keys passed in as parameters
 #       - name: sally
 #         authorized_keys:
 #         - ssh-rsa abcdef...
 #         - ssh-rsa ghiklm...
-
 #
-# Set user_rbash_links for links to be set in the restricted
-# user's bin dir by default we only allow /usr/bin/sudo
+# By default for restricted users we only allow sudo, if you
+# want to provide more binaries add them to user_rbash_links
+# which can be passed in as a paramter to the role.
 #
 
 - fail: you must pass in a user_info parameter to this role