david_igou.routeros_configuration.user_password role – Set/rotate RouterOS /user passwords over the API.

Note

This role is part of the david_igou.routeros_configuration collection (version 0.0.8-alpha).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install david_igou.routeros_configuration.

To use it in a playbook, specify: david_igou.routeros_configuration.user_password.

Entry point main – Set/rotate RouterOS /user passwords over the API.

Synopsis

  • Sets passwords for existing users. Not idempotent (passwords are write-only).

Parameters

Parameter

Comments

routeros_api_hostname

string

API hostname/IP of the device.

Default: "{{ inventory_hostname }}"

routeros_api_password

string

API password. Secret — supply via vault.

routeros_api_port

any

TCP port; empty lets the module choose from tls.

Default: ""

routeros_api_tls

boolean

Use TLS (api-ssl).

Choices:

  • false

  • true ← (default)

routeros_api_username

string

API username.

Default: "admin"

routeros_api_validate_certs

boolean

Validate the device TLS certificate.

Choices:

  • false

  • true ← (default)

routeros_user_passwords

list / elements=dictionary

Users and the passwords to set (secret — supply via Vault).

Default: []

name

string / required

Existing user name.

password

string / required

New password.

Examples

# Passwords are secrets — always supply them via Ansible Vault.
#
# Rotate one user's password. Not idempotent (passwords are write-only), so
# the task reports changed on every run.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.user_password
      vars:
        routeros_user_passwords:
          - name: admin
            password: "{{ vault_admin_password }}"

# Rotate several users at once.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.user_password
      vars:
        routeros_user_passwords:
          - name: admin
            password: "{{ vault_admin_password }}"
          - name: monitoring
            password: "{{ vault_monitoring_password }}"

# Source the credentials from a vaulted group_vars file so no secret appears
# in the playbook:
#
#   # group_vars/routers/vault.yml  (encrypt with ansible-vault)
#   routeros_user_passwords:
#     - name: admin
#       password: S3cr3t-admin
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.user_password