ZNC password hash and salt generation was not working. Now using builtin znc tool to generate it. Also changed znc config options slightly.

filter_plugins/password_hash.py

@@ -2,40 +2,25 @@ from ansible.errors import AnsibleError, AnsibleUndefinedVariable
 from jinja2 import StrictUndefined
 __metaclass__ = type
 
-
 try:
     import passlib.hash
     HAS_LIB = True
 except ImportError:
     HAS_LIB = False
 
-
 def check_lib():
     if not HAS_LIB:
         raise AnsibleError('You need to install "passlib" prior to running '
                            'password_hash-based filters')
 
-
 def doveadm_pw_hash(password):
     check_lib()
     if type(password) is StrictUndefined:
         raise AnsibleUndefinedVariable('Please pass a string into this password_hash-based filter')
     return passlib.hash.sha512_crypt.encrypt(password, rounds=5000)
 
-
-def znc_pw_salt(password):
-    return doveadm_pw_hash(password).split("$")[0]
-
-
-def znc_pw_hash(password):
-    return doveadm_pw_hash(password).split("$")[1]
-
-
 class FilterModule(object):
-
     def filters(self):
         return {
             'doveadm_pw_hash': doveadm_pw_hash,
-            'znc_pw_salt': znc_pw_salt,
-            'znc_pw_hash': znc_pw_hash,
         }

group_vars/sovereign

@@ -45,7 +45,6 @@ irc_nick: (required)
 irc_ident: (required)
 irc_realname: (required)
 irc_quitmsg: (required)
-irc_password: TODO
 
 # xmpp
 prosody_admin: "{{ admin_email }}"

roles/ircbouncer/defaults/main.yml

@@ -1 +1,14 @@
-irc_timezone: "{{ common_timezone|default('Etc/UTC') }}"
+secret_root: '{{ inventory_dir | realpath }}'
+secret_name: 'secret'
+secret: '{{ secret_root + "/" + secret_name }}'
+
+irc_admin_username: "{{ main_user_name }}"
+irc_admin_password: "{{ lookup('password', secret + '/' + 'irc_admin_password length=32') }}"
+
+irc_nick: "{{ main_user_name }}"
+irc_altnick: "{{ irc_nick }}_"
+irc_ident: "{{ main_user_name }}"
+irc_realname: "{{ main_user_name }}"
+irc_quitmsg: "Bye folks"
+
+irc_timezone: "{{ common_timezone | default('Etc/UTC') }}"

roles/ircbouncer/tasks/znc.yml

@@ -1,9 +1,14 @@
+---
 # more or less as per http://wiki.znc.in/Running_ZNC_as_a_system_daemon
 
 - name: Install znc
-  apt: pkg={{ item }} state=present
-  with_items:
+  apt:
+    name: "{{ packages }}"
+    state: present
+  vars:
+    packages:
     - znc
+    - expect
   tags:
     - dependencies
 
@@ -22,6 +27,7 @@
     - moddata
     - modules
     - users
+    - configs
 
 - name: Copy znc service file into place
   copy: src=etc_systemd_system_znc.service dest=/etc/systemd/system/znc.service mode=0644
@@ -51,14 +57,30 @@
   ignore_errors: True
   changed_when: False  # never report as "changed"
 
-- name: Create znc config directory
-  file: state=directory path=/usr/lib/znc/configs group=znc owner=znc
-
 - name: Copy znc configuration file into place
   template: src=usr_lib_znc_configs_znc.conf.j2 dest=/usr/lib/znc/configs/znc.conf owner=znc group=znc
   when: znc_config.rc != 0
   notify: restart znc
 
+- name: Copy expect script for znc password generation
+  template: src=root_znc_pw.j2 dest=/root/znc_pw mode=0777
+  when: znc_config.rc != 0
+
+- name: Run script to generate znc hash and salt
+  shell: /root/znc_pw | head --lines=-1 | tail --lines=+7
+  register: znc_config_pass
+  when: znc_config.rc != 0
+
+- name: Put generated hash and salt into configuration file
+  blockinfile:
+    block: "{{ znc_config_pass.stdout }}"
+    path: /usr/lib/znc/configs/znc.conf
+    marker: "// {mark} ANSIBLE MANAGED BLOCK"
+  when: znc_config.rc != 0
+
+- name: Remove expect script
+  file: path=/root/znc_pw state=absent
+
 - name: Set firewall rule for znc
   ufw: rule=allow port=6697 proto=tcp
   tags: ufw

roles/ircbouncer/templates/root_znc_pw.j2

@@ -0,0 +1,11 @@
+#!/usr/bin/expect -f
+
+spawn /usr/bin/znc --makepass
+
+expect "Enter password:"
+send -- "{{ irc_admin_password }}\r"
+
+expect "Confirm password:"
+send -- "{{ irc_admin_password }}\r"
+
+interact

roles/ircbouncer/templates/usr_lib_znc_configs_znc.conf.j2

@@ -40,10 +40,10 @@ Version = 1.0
 	SSL = false
 </Listener>
 
-<User {{ irc_nick }}>
+<User {{ irc_admin_username }}>
 	Admin = true
 	Allow = *
-	AltNick = {{ irc_nick }}_
+	AltNick = {{ irc_altnick }}
 	AppendTimestamp = false
 	AutoClearChanBuffer = true
 	Buffer = 5000
@@ -56,7 +56,7 @@ Version = 1.0
 	LoadModule = perform
 	LoadModule = block_motd
 	LoadModule = clientnotify
-	MaxNetworks = 1
+	MaxNetworks = 5
 	MultiClients = true
 	Nick = {{ irc_nick }}
 	PrependTimestamp = true
@@ -65,11 +65,8 @@ Version = 1.0
 	TimestampFormat = [%H:%M:%S]
 	Timezone = {{ irc_timezone }}
 
-	<Pass password>
-	        Method = sha256
-	        Hash = {{ irc_password | znc_pw_hash }}
-	        Salt = {{ irc_password | znc_pw_salt }}
-	</Pass>
+// BEGIN ANSIBLE MANAGED BLOCK
+// END ANSIBLE MANAGED BLOCK
 
 	<Network freenode>
 		BindHost = 0.0.0.0