Question about using role as non-root user

[CardanoUmbrella]

Hello, Thanks for making this ansible role!
My goal is to use it to provision a server with nvm, node, and npm usable by my non-root user who has sudo privileges.

I have a task that looks like this (cu.nodesjs is my fork name of your repo):

- name: Include cu.nodejs role
  become: yes
  become_user: "{{admin_user}}"
  include_role:
    name: cu.nodejs

After running the above successfully I have access to nvm when logged into my server as the admin_user (not root).
However I don't have access to node or npm. Is it possible to access these as non-root user?

Thanks for your time.

[fubarhouse]

@CardanoUmbrella,

Apologies for the delay in response - I'm clearly not getting notifications for this repository.

This role heavily used sudo in the past but a lot of work happened to prevent it from being needed. Ideally you should be able to run the role as non-root and that's the way it is preferred for this very reason.

I will do some testing and get back to you with confirmation.

[fubarhouse]

@CardanoUmbrella,

It seems there's but one more task to make usable to non-root users, which follows:

- name: "NVM | Create an executable"
  become: yes
  become_user: root
  template:
    src: "nvm.sh"
    dest: "{{ nvm_symlink_exec }}"
    mode: 0755

I'll begin some work on this, which should cleanly support a solution to the problem raised in #75. I've a very effective way of testing Ansible roles now, so I should make quick work of it.

Edit: Could you please test against branch issue-76? It features minor changes, but pretty broad changes which shouldn't impact anybody but it does allow anybody to configure where the symlinks are created which impacts the task above and the issue from #75. The tests on Travis are now beginning to pass.

[CardanoUmbrella]

Thanks for getting back to me and looking into this. Great work!

[watsonb]

I'm trying issue-76 as follows:
molecule -> requirements.yml

- src: https://github.com/fubarhouse/ansible-role-nodejs.git
  name: fubarhouse.nodejs
  scm: git
  version: issue-76

Install the role via molecule:

molecule dependency
- extracting fubarhouse.nodejs to /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/roles/fubarhouse.nodejs
    - fubarhouse.nodejs (issue-76) was installed successfully

Apply the role as part of molecule's prepare playbook:

- name: Prepare
  hosts: all
  gather_facts: true
  # become: true
  pre_tasks:

    - name: LINEINFILE | Give ssh user passwordless sudo
      become: true
      become_user: root
      lineinfile:
        create: true
        group: root
        owner: root
        mode: 'u=r,g=,o='
        path: "/etc/sudoers.d/{{ molecule_yml.driver.ssh_user }}"
        line: "{{ molecule_yml.driver.ssh_user }}     ALL=(ALL)   NOPASSWD: ALL"
        state: present

  roles:
    # - role: ar_nodejs
    - role: fubarhouse.nodejs

Role fails on trying to install packages as non-root user:

TASK [fubarhouse.nodejs : NodeJS | Install dependencies (CentOS)] **************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal] => (item=[]) 
    failed: [centos-7-ar-hippocampe-benlocal] (item=[u'curl', u'gcc', u'git', u'findutils', u'make', u'rsync', u'tar']) => {"changed": false, "item": ["curl", "gcc", "git", "findutils", "make", "rsync", "tar"], "msg": "You need to be root to perform this command.\n", "rc": 1, "results": ["curl-7.29.0-46.el7.x86_64 providing curl is already installed", "1:findutils-4.5.11-5.el7.x86_64 providing findutils is already installed", "1:make-3.82-23.el7.x86_64 providing make is already installed", "2:tar-1.26-34.el7.x86_64 providing tar is already installed", "Loaded plugins: fastestmirror\n"]}
    
    TASK [fubarhouse.nodejs : NodeJS | Install dependencies (Debian)] **************
    failed: [ubuntu-1604-ar-hippocampe-benlocal] (item=[u'curl', u'gcc', u'git', u'findutils', u'make', u'rsync', u'tar']) => {"changed": false, "cmd": "apt-get update", "item": ["curl", "gcc", "git", "findutils", "make", "rsync", "tar"], "msg": "W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (1: Operation not permitted)\nE: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)\nE: Unable to lock directory /var/lib/apt/lists/\nW: Problem unlinking the file /var/cache/apt/pkgcache.bin - RemoveCaches (13: Permission denied)\nW: Problem unlinking the file /var/cache/apt/srcpkgcache.bin - RemoveCaches (13: Permission denied)", "rc": 100, "stderr": "W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (1: Operation not permitted)\nE: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)\nE: Unable to lock directory /var/lib/apt/lists/\nW: Problem unlinking the file /var/cache/apt/pkgcache.bin - RemoveCaches (13: Permission denied)\nW: Problem unlinking the file /var/cache/apt/srcpkgcache.bin - RemoveCaches (13: Permission denied)\n", "stderr_lines": ["W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (1: Operation not permitted)", "E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)", "E: Unable to lock directory /var/lib/apt/lists/", "W: Problem unlinking the file /var/cache/apt/pkgcache.bin - RemoveCaches (13: Permission denied)", "W: Problem unlinking the file /var/cache/apt/srcpkgcache.bin - RemoveCaches (13: Permission denied)"], "stdout": "Reading package lists...\n", "stdout_lines": ["Reading package lists..."]}

I've used your role in the past and am maintaining a local fork of it, but I'm seeing failures on CentOS 7 these days, to which I see you have another fix via git fetch in another issue. Not sure if the problems I'm seeing are with your role or with the whole Ansible/NVM thing after the fact (kinda like how Ansible and virtualenv don't play nice). For example, I use your role to install NVM and NodeJS 10.10.0 with NPM and then request that your role install bower, but after that I don't have nvm or bower available in CentOS (when using a shell command via Ansible). If I SSH into the box as the user (root in my case) with an interactive session/shell, things seem OK.

[fubarhouse]

@watsonb,

Thanks, that's a really helpful summary.

1. It might be best to change some of the logic for dependencies, what're your thoughts?
2. I will organise to process Centos 7 install fails, default version of git lacks the features for nvm install.sh #57 based upon the above feedback - I was waiting for feedback on that. (see 583d9d2 for formal commit - PR to follow)
3. It seems the role was executed as root - was that intentional (via Ansible), and do you have a way which I can reproduce those results? It actually sounds like a $PATH/profile issue...
4. Despite the failing dependency tasks which could resolve to present rather than installed, are there any other problems you haven't raised associated to running as a regular user?

[watsonb]

@fubarhouse,

Thank you for authoring this role to begin with. As for your items:

1. Clearly if we're going to need to install OS packages as dependencies to support this, I think the role will require privilege escalation on that task at a minimum. I don't have a problem with that so long as I don't have use a become: true at the play level. As for the logic you have for determining OS family and distribution, I'm comfortable with what you have now, though I did have to change it locally a while back as CentOS wasn't properly being picked up to use YUM as the package manager. It seems you've fixed this since then.
2. I greatly appreciate you looking to fold in Centos 7 install fails, default version of git lacks the features for nvm install.sh #57. It should help ensure we get the right version of NVM installed and will eliminate this in playbook output:

fatal: [centos-7-ar-hippocampe-benlocal]: FAILED! => {"changed": true, "cmd": "~/.nvm/install.sh", "delta": "0:00:00.758578", "end": "2018-09-17 15:52:52.805230", "msg": "non-zero return code", "rc": 1, "start": "2018-09-17 15:52:52.046652", "stderr": "Failed to update nvm, run 'git fetch' in /root/.nvm yourself.", "stderr_lines": ["Failed to update nvm, run 'git fetch' in /root/.nvm yourself."], "stdout": "=> nvm is already installed in /root/.nvm, trying to update using git\n\r=> ", "stdout_lines": ["=> nvm is already installed in /root/.nvm, trying to update using git", "", "=> "]}
    ...ignoring

3. I commented out the become: true from the playbook, but my pre_task does run as root to muck with sudoers. I think the role is being applied (as indicated above) without escalation (root), hence the failure on the packages being installed. That being said, since NVM is a user-space tool, I would like to be able to ensure NVM is installed and that Node/NPM are available for individual users, to include the root user.

To that end, if I do something like this:

- name: PLAY | Setup NVM/Node/NPM for user foo
  become: true
  become_user: foo
  hosts: localhost
  gather_facts: true
  roles:
    - fubarhouse.nodejs

then I would expect to be able to access the system as user foo and, as that user, be able to nvm use <version> and npm install <module> without issue.

Likewise, if I do this:

- name: PLAY | Setup NVM/Node/NPM for user root
  become: true
  become_user: root  #note, this is the default and this line is redundant but is here for completeness
  hosts: localhost
  gather_facts: true
  roles:
    - fubarhouse.nodejs

then I would expect to be able to access the system as the root user and do typical NVM/Node/NPM things as well.

4. I don't think I've run into many other issues. The behavior seems pretty rock solid on Ubuntu and some of this could be due to my misunderstanding of shell profiles and your exposure of the variable shell_profiles in defaults/main.yml. I see that it is a list of profiles to check and you have tasks that are going to muck with $PATH to ensure NVM is loaded when a user logs in, which I agree with. On CentOS, it seems the file would be ~/.bash_profile which seems to jive with your default entry in the list. On Ubuntu 16.04, I think I'd have to add ~/.profile to the list, which is not a problem.

Aside from that, I think your role is great and have used it several times. I think where I'm going to slip up here in the future is using Ansible to do other things that make use of Node/NPM after I've applied your role. Since you use NVM (which I agree with by the way) and NVM is a shell manipulation thing just like Python's virtualenv, I suspect that later Ansible tasks that need to, say, use the npm Ansible module will run into issues since Ansible connects with /bin/sh and this NVM shell magic won't be available at that time.

This behavior is a little wonky across distributions as well and I don't think this is a problem you need to solve as I believe your role does its job.

[fubarhouse]

@watsonb,

You've helped clarify a few things there, thank you very much for your help.

• $PATH issues are identified as being caused by the playbook being executed using become
• Packages need sudo/root access

I think the proposed changes are suitable and adequate, but as stated in 1, OS packages require sudo access and there's no way around that. So, I will propose a change to this which should accommodate this. I intend to introduce a boolean to tell the role to include dependency installation and the use of become would be included. This also assumes the user has either not set up the delegate previously, or the user has setup sudoers as required - in which case the sudo password would otherwise need to be passed to Ansible and this will all need to be documented.

Stay tuned.

On a side-node, I am... very much frustrated with virtualenv... my Python role should soon have its biggest update in a very long time because of this - but my Ruby role is still in a a state... Any advice you can provide would be appreciated.

[watsonb]

@fubarhouse ,

Yes, virtualenv can be a bit tricky with Ansible. We actually have an internal role for installing virtualenv on target hosts, creating a new virtualenv, and installing a requested Ansible version into it, along with other helpful Python modules for various cloud providers.

You'll have to study and play with the variable ansible_python_interpreter and set it accordingly depending on the context of a specific play or task. We love virtualenv because we can have multiple versions of Ansible on the same machine for evaluation purposes and the like, and we typically execute all of our Ansible playbooks from a machine via a virtualenv. Where it becomes tricky, in this scenario, is if you're executing a task on the local machine (e.g. connection: local or delegate_to: localhost). By default Ansible will use the Python at /usr/bin/python (I think), but if you're executing a task locally while running Ansible from a virtualenv, then you need to set ansible_python_interpreter to the path of the Python executable within the virtualenv. I think you should be able to set a fact via a shell module call against the local machine ahead of time by running the command which python to get that path and set ansible_python_interpreter accordingly.

I first stumbled onto solutions by reading this article: https://dmsimard.com/2016/01/08/selinux-python-virtualenv-chroot-and-ansible-dont-play-nice/

Hope this helps.

[fubarhouse]

183a7f6 appears to be achieving what is proposed in #76 (comment)

• https://travis-ci.org/fubarhouse/ansible-role-nodejs/builds/430506735

Feedback is welcome!

[watsonb]

Here is the output of my latest attempt.

First the pre-conditions going in (molecule config):

# Example of VMWare VMs spun up with sizing/template info
platforms:
  - name: ubuntu-1604-ar-hippocampe-$BRANCH_NAME
    template: 'ubuntu-1604-server-02'
    disk_size: 30
    memory_mb: 1048
    num_cpus: 1
    groups:
      - ubuntu
      - hippocampe
      - nodejs
  - name: centos-7-ar-hippocampe-$BRANCH_NAME
    template: 'centos-7-server-01'
    disk_size: 30
    memory_mb: 1048
    num_cpus: 1
    groups:
      - centos
      - hippocampe
      - nodejs
provisioner:
  name: ansible
  inventory:
    group_vars:
      ubuntu:
        shell_profiles:
          - .profile
      centos:
        shell_profiles:
          - .bash_profile
      nodejs:
        install_nvm_deps: true
        nvm_symlink_dir: /usr/local/bin
        nvm_version: v0.33.11
        nodejs_clean_install: true
        node_version: 10.10.0
        node_versions:
          - 8.12.0
        node_packages:
          - bower

The prepare playbook that applies the role:

- name: Prepare
  hosts: all
  gather_facts: true
  # become: true
  # become_user: root
  pre_tasks:

    - name: LINEINFILE | Give ssh user passwordless sudo
      become: true
      become_user: root
      lineinfile:
        create: true
        group: root
        owner: root
        mode: 'u=r,g=,o='
        path: "/etc/sudoers.d/{{ molecule_yml.driver.ssh_user }}"
        line: "{{ molecule_yml.driver.ssh_user }}     ALL=(ALL)   NOPASSWD: ALL"
        state: present

  roles:
    # - role: ar_nodejs
    - role: fubarhouse.nodejs

Shell output:

(venv_ansible-2.5.2) bw.admin@knebawils002:/workspace/vsts/ansible/roles/ar_hippocampe$ molecule dependency
--> Validating schema /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/molecule.yml.
Validation completed successfully.
--> Test matrix
    
└── default
    └── dependency
    
--> Scenario: 'default'
--> Action: 'dependency'
    - changing role ar_nodejs from v0.2.0 to v0.2.0
    - extracting ar_nodejs to /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/roles/ar_nodejs
    - ar_nodejs (v0.2.0) was installed successfully
    - changing role config_encoder_filters from  to unspecified
    - extracting config_encoder_filters to /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/roles/config_encoder_filters
    - config_encoder_filters was installed successfully
    - changing role fubarhouse.nodejs from issue-76 to issue-76
    - extracting fubarhouse.nodejs to /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/roles/fubarhouse.nodejs
    - fubarhouse.nodejs (issue-76) was installed successfully
Dependency completed successfully.
(venv_ansible-2.5.2) bw.admin@knebawils002:/workspace/vsts/ansible/roles/ar_hippocampe$ molecule create
--> Validating schema /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/molecule.yml.
Validation completed successfully.
--> Test matrix
    
└── default
    ├── create
    └── prepare
    
--> Scenario: 'default'
--> Action: 'create'
    
    PLAY [Create] ******************************************************************
    
    TASK [VMWARE_GUEST | Ensure VMs exist in VMware] *******************************
    changed: [localhost] => (item=None)
    changed: [localhost] => (item=None)
    TASK [Populate instance config dict] *******************************************
    ok: [localhost] => (item=None)
    ok: [localhost] => (item=None)
    
    TASK [Convert instance config dict to a list] **********************************
    ok: [localhost]
    
    TASK [Dump instance config] ****************************************************
    changed: [localhost]
    
    TASK [render ssh_config for instances] *****************************************
    changed: [localhost]
    
    TASK [Wait for system to become reachable] *************************************
    ok: [localhost] => (item=None)
    ok: [localhost] => (item=None)
    
    PLAY RECAP *********************************************************************
    localhost                  : ok=6    changed=3    unreachable=0    failed=0
    
    
--> Scenario: 'default'
--> Action: 'prepare'
    
    PLAY [Prepare] *****************************************************************
    
    TASK [Gathering Facts] *********************************************************
    ok: [ubuntu-1604-ar-hippocampe-benlocal]
    ok: [centos-7-ar-hippocampe-benlocal]
    
    TASK [LINEINFILE | Give ssh user passwordless sudo] ****************************
    changed: [ubuntu-1604-ar-hippocampe-benlocal]
    changed: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : include_tasks] ***************************************
    included: /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/roles/fubarhouse.nodejs/tasks/setup.yml for ubuntu-1604-ar-hippocampe-benlocal, centos-7-ar-hippocampe-benlocal
    
    TASK [fubarhouse.nodejs : NodeJS | Install dependencies (CentOS)] **************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal] => (item=[]) 
    changed: [centos-7-ar-hippocampe-benlocal] => (item=[u'curl', u'gcc', u'git', u'findutils', u'make', u'rsync', u'tar'])
    
    TASK [fubarhouse.nodejs : NodeJS | Install dependencies (Debian)] **************
    skipping: [centos-7-ar-hippocampe-benlocal] => (item=[]) 
changed: [ubuntu-1604-ar-hippocampe-benlocal] => (item=[u'curl', u'gcc', u'git', u'findutils', u'make', u'rsync', u'tar'])
[DEPRECATION WARNING]: State 'installed' is deprecated. Using state 'present'
instead.. This feature will be removed in version 2.9. Deprecation warnings can
 be disabled by setting deprecation_warnings=False in ansible.cfg.
    
    TASK [fubarhouse.nodejs : NodeJS | Install dependencies (RedHat)] **************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal] => (item=[]) 
    skipping: [centos-7-ar-hippocampe-benlocal] => (item=[]) 
    
    TASK [fubarhouse.nodejs : Set default ivm installation directory] **************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : Set default nvm installation directory] **************
    ok: [ubuntu-1604-ar-hippocampe-benlocal]
    ok: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : include_tasks] ***************************************
    included: /workspace/vsts/ansible/roles/ar_hippocampe/molecule/default/roles/fubarhouse.nodejs/tasks/nvm.yml for ubuntu-1604-ar-hippocampe-benlocal, centos-7-ar-hippocampe-benlocal
    
    TASK [fubarhouse.nodejs : NVM | Looking at shell profiles] *********************
    ok: [ubuntu-1604-ar-hippocampe-benlocal] => (item=.profile)
    ok: [centos-7-ar-hippocampe-benlocal] => (item=.bash_profile)
    
    TASK [fubarhouse.nodejs : NVM | Clean-up] **************************************
    ok: [ubuntu-1604-ar-hippocampe-benlocal]
    ok: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Clean-up default version from shell profiles] ***
    ok: [ubuntu-1604-ar-hippocampe-benlocal] => (item={'_ansible_parsed': True, u'stat': {u'isuid': False, u'uid': 1000, u'exists': True, u'attr_flags': u'e', u'woth': False, u'isreg': True, u'device_type': 0, u'mtime': 1494938978.0, u'block_size': 4096, u'inode': 523300, u'isgid': False, u'size': 655, u'executable': False, u'roth': True, u'charset': u'us-ascii', u'readable': True, u'version': u'18446744072056662227', u'pw_name': u'ansible', u'gid': 1000, u'ischr': False, u'wusr': True, u'writeable': True, u'isdir': False, u'blocks': 8, u'xoth': False, u'rusr': True, u'nlink': 1, u'issock': False, u'rgrp': True, u'gr_name': u'ansible', u'path': u'.profile', u'xusr': False, u'atime': 1531775255.2080011, u'mimetype': u'text/plain', u'ctime': 1524504892.2734447, u'isblk': False, u'xgrp': False, u'dev': 64512, u'wgrp': False, u'isfifo': False, u'mode': u'0644', u'checksum': u'dded66a8a7137b974a4f57a4ec378eda51fbcae6', u'islnk': False, u'attributes': [u'extents']}, u'changed': False, '_ansible_no_log': False, 'item': u'.profile', '_ansible_item_result': True, 'failed': False, u'invocation': {u'module_args': {u'checksum_algorithm': u'sha1', u'get_checksum': True, u'follow': False, u'path': u'.profile', u'get_md5': None, u'get_mime': True, u'get_attributes': True}}, '_ansible_ignore_errors': None})
    ok: [centos-7-ar-hippocampe-benlocal] => (item={'_ansible_parsed': True, u'stat': {u'isuid': False, u'uid': 1001, u'exists': True, u'attr_flags': u'', u'woth': False, u'isreg': True, u'device_type': 0, u'mtime': 1523407981.0, u'block_size': 4096, u'inode': 33582193, u'isgid': False, u'size': 193, u'executable': False, u'roth': True, u'charset': u'us-ascii', u'readable': True, u'version': u'18446744073125667890', u'pw_name': u'ansible', u'gid': 1001, u'ischr': False, u'wusr': True, u'writeable': True, u'isdir': False, u'blocks': 8, u'xoth': False, u'rusr': True, u'nlink': 1, u'issock': False, u'rgrp': True, u'gr_name': u'ansible', u'path': u'.bash_profile', u'xusr': False, u'atime': 1532397599.7463272, u'mimetype': u'text/plain', u'ctime': 1528463254.065362, u'isblk': False, u'xgrp': False, u'dev': 64768, u'wgrp': False, u'isfifo': False, u'mode': u'0644', u'checksum': u'82a36c2c2e245f5416ca253fb38ff3346d6e8d7e', u'islnk': False, u'attributes': []}, u'changed': False, '_ansible_no_log': False, 'item': u'.bash_profile', '_ansible_item_result': True, 'failed': False, u'invocation': {u'module_args': {u'checksum_algorithm': u'sha1', u'get_checksum': True, u'follow': False, u'path': u'.bash_profile', u'get_md5': None, u'get_mime': True, u'get_attributes': True}}, '_ansible_ignore_errors': None})
    
    TASK [fubarhouse.nodejs : NVM | Clean-up other versions from shell profiles] ***
    ok: [ubuntu-1604-ar-hippocampe-benlocal] => (item=[{'_ansible_parsed': True, u'stat': {u'isuid': False, u'uid': 1000, u'exists': True, u'attr_flags': u'e', u'woth': False, u'isreg': True, u'device_type': 0, u'mtime': 1494938978.0, u'block_size': 4096, u'inode': 523300, u'isgid': False, u'size': 655, u'wgrp': False, u'executable': False, u'charset': u'us-ascii', u'readable': True, u'version': u'18446744072056662227', u'pw_name': u'ansible', u'gid': 1000, u'ischr': False, u'wusr': True, u'writeable': True, u'mimetype': u'text/plain', u'blocks': 8, u'xoth': False, u'islnk': False, u'nlink': 1, u'issock': False, u'rgrp': True, u'gr_name': u'ansible', u'path': u'.profile', u'xusr': False, u'atime': 1531775255.2080011, u'isdir': False, u'ctime': 1524504892.2734447, u'isblk': False, u'xgrp': False, u'dev': 64512, u'roth': True, u'isfifo': False, u'mode': u'0644', u'checksum': u'dded66a8a7137b974a4f57a4ec378eda51fbcae6', u'rusr': True, u'attributes': [u'extents']}, '_ansible_item_result': True, '_ansible_no_log': False, 'failed': False, u'changed': False, 'item': u'.profile', u'invocation': {u'module_args': {u'checksum_algorithm': u'sha1', u'get_checksum': True, u'follow': False, u'path': u'.profile', u'get_md5': None, u'get_mime': True, u'get_attributes': True}}, '_ansible_ignore_errors': None}, u'8.12.0'])
    ok: [centos-7-ar-hippocampe-benlocal] => (item=[{'_ansible_parsed': True, u'stat': {u'isuid': False, u'uid': 1001, u'exists': True, u'attr_flags': u'', u'woth': False, u'isreg': True, u'device_type': 0, u'mtime': 1523407981.0, u'block_size': 4096, u'inode': 33582193, u'isgid': False, u'size': 193, u'wgrp': False, u'executable': False, u'charset': u'us-ascii', u'readable': True, u'version': u'18446744073125667890', u'pw_name': u'ansible', u'gid': 1001, u'ischr': False, u'wusr': True, u'writeable': True, u'mimetype': u'text/plain', u'blocks': 8, u'xoth': False, u'islnk': False, u'nlink': 1, u'issock': False, u'rgrp': True, u'gr_name': u'ansible', u'path': u'.bash_profile', u'xusr': False, u'atime': 1532397599.7463272, u'isdir': False, u'ctime': 1528463254.065362, u'isblk': False, u'xgrp': False, u'dev': 64768, u'roth': True, u'isfifo': False, u'mode': u'0644', u'checksum': u'82a36c2c2e245f5416ca253fb38ff3346d6e8d7e', u'rusr': True, u'attributes': []}, '_ansible_item_result': True, '_ansible_no_log': False, 'failed': False, u'changed': False, 'item': u'.bash_profile', u'invocation': {u'module_args': {u'checksum_algorithm': u'sha1', u'get_checksum': True, u'follow': False, u'path': u'.bash_profile', u'get_md5': None, u'get_mime': True, u'get_attributes': True}}, '_ansible_ignore_errors': None}, u'8.12.0'])
    
    TASK [fubarhouse.nodejs : NodeJS | Remove imported exports not associated to specific versions] ***
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Check] *****************************************
    ok: [ubuntu-1604-ar-hippocampe-benlocal]
    ok: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Get distribution] ******************************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Create temporary extraction directory] *********
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Create pernament extraction directory] *********
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Unpack distribution] ***************************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Moving to installation directory] **************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Moving to installation directory] **************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal]
    skipping: [centos-7-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Remove temporary data] *************************
    skipping: [ubuntu-1604-ar-hippocampe-benlocal] => (item=/tmp/v0.33.11.tar.gz) 
    skipping: [ubuntu-1604-ar-hippocampe-benlocal] => (item=/tmp/nvm-v0.33.11) 
    skipping: [centos-7-ar-hippocampe-benlocal] => (item=/tmp/v0.33.11.tar.gz) 
    skipping: [centos-7-ar-hippocampe-benlocal] => (item=/tmp/nvm-v0.33.11) 
    
    TASK [fubarhouse.nodejs : NVM | Clone] *****************************************
    changed: [centos-7-ar-hippocampe-benlocal]
    changed: [ubuntu-1604-ar-hippocampe-benlocal]
    
    TASK [fubarhouse.nodejs : NVM | Install] ***************************************
    changed: [ubuntu-1604-ar-hippocampe-benlocal]
    fatal: [centos-7-ar-hippocampe-benlocal]: FAILED! => {"changed": true, "cmd": "~/.nvm/install.sh", "delta": "0:00:00.574416", "end": "2018-09-19 16:30:53.438248", "msg": "non-zero return code", "rc": 1, "start": "2018-09-19 16:30:52.863832", "stderr": "Failed to update nvm, run 'git fetch' in /home/ansible/.nvm yourself.", "stderr_lines": ["Failed to update nvm, run 'git fetch' in /home/ansible/.nvm yourself."], "stdout": "=> nvm is already installed in /home/ansible/.nvm, trying to update using git\n\r=> ", "stdout_lines": ["=> nvm is already installed in /home/ansible/.nvm, trying to update using git", "", "=> "]}
    
    TASK [fubarhouse.nodejs : NVM | Create an executable] **************************
    fatal: [ubuntu-1604-ar-hippocampe-benlocal]: FAILED! => {"changed": false, "checksum": "e0a51eb58a55439220e5563058b8aece0dd91d76", "msg": "Destination /usr/local/bin not writable"}
    
    PLAY RECAP *********************************************************************
    centos-7-ar-hippocampe-benlocal : ok=12   changed=3    unreachable=0    failed=1   
    ubuntu-1604-ar-hippocampe-benlocal : ok=13   changed=4    unreachable=0    failed=1 

It looks like my CentOS instance needs that git fetch fix you proposed in another issue. Should I specify another location other than /usr/local/bin if I'm running this without become: true. As you can see in my prepare playbook, I explicitly commented out become: true and become_user: root so the playbook itself would run unprivileged but individual tasks that require it can escalate if needed. You can see that the user I'm running as was able to install package dependencies as indicated by install_nvm_deps: true and getting past those tasks.

[fubarhouse]

So in addition to #57 (which is now ready for merging), the latest version of issue-76 is now suitable for merging.

I would like advice on one point you raised - the default location for the binary links is currently /usr/local/bin and in the case which caused this issue it's not writable by unprivileged users. The intention was to have users configure the path as required, however it's subject to change - I'm interested in any recommendations for this.

My question here is...

Do you have a recommended default to replace this path with, which accommodates the requirement and is also typically available in $PATH?

Otherwise feel free to correct me in anything I've stated.