First version

finish.yml

@@ -0,0 +1,39 @@
+- name: End of the build (SSH settings of the ICPC image, cleanup, power off)
+  hosts: all
+  become: yes
+  tasks:
+    # build.sh replaced these settings to log in during the build
+    - name: Restore the SSH settings of the ICPC image
+      copy:
+        dest: /etc/ssh/sshd_config.d/icpc.conf
+        mode: '0644'
+        content: |
+          PasswordAuthentication no
+          DenyGroups judges teams
+
+    - name: Remove the SSH settings of the build
+      file:
+        path: /etc/ssh/sshd_config.d/00-build.conf
+        state: absent
+
+    - name: Empty the package cache
+      command: apt-get clean
+      changed_when: false
+
+    # Last task, in one go because Ansible may be using sudo through the team
+    # account (first build) or the icpc account (next builds):
+    # - icpc, the administrator account, gets the new password
+    # - team, the account of the teams, gets its new password if one is given
+    # - team leaves the sudo group (the ICPC image gives it sudo with the
+    #   public password "contest")
+    - name: Set the passwords, remove team from sudo and power off
+      shell: |
+        set -e
+        echo "icpc:$ADMIN_PASS" | chpasswd
+        if [ -n "$TEAM_PASS" ]; then echo "team:$TEAM_PASS" | chpasswd; fi
+        if id -nG team | grep -qw sudo; then gpasswd -d team sudo; fi
+        systemd-run --on-active=5 systemctl poweroff
+      environment:
+        ADMIN_PASS: "{{ admin_pass }}"
+        TEAM_PASS: "{{ team_pass | default('') }}"
+      no_log: true