commit 969f9703e96928efb0e625111cf1ab296b199d4f
parent f1dd4fb3c05cd769bbe84abe91ab9373f6a42eea
Author: Chris Roberts <chris.roberts@learningunix.net>
Date: Mon, 22 Jun 2026 09:24:13 -0500
added ssh roles and pass repo cloning
Diffstat:
7 files changed, 80 insertions(+), 0 deletions(-)
diff --git a/roles/packages/vars/main.yml b/roles/packages/vars/main.yml
@@ -1,6 +1,9 @@
---
packages_to_install:
- ansible
+ - git
+ - gnupg
+ - pass
- ansible-lint
- azure-cli
- ex-vi-compat
diff --git a/roles/pass/meta/main.yml b/roles/pass/meta/main.yml
@@ -0,0 +1,6 @@
+---
+galaxy_info:
+ author: cjr
+ description: Clone the pass password store
+ license: BSD-3-Clause
+ min_ansible_version: "2.1"
diff --git a/roles/pass/tasks/main.yml b/roles/pass/tasks/main.yml
@@ -0,0 +1,7 @@
+---
+- name: Clone password store
+ ansible.builtin.git:
+ repo: cjr@git:/home/cjr/.password-store
+ dest: "{{ ansible_facts['user_dir'] }}/.password-store"
+ update: true
+ version: main
diff --git a/roles/ssh/meta/main.yml b/roles/ssh/meta/main.yml
@@ -0,0 +1,6 @@
+---
+galaxy_info:
+ author: cjr
+ description: Deploy SSH keys and config from pass
+ license: BSD-3-Clause
+ min_ansible_version: "2.1"
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
@@ -0,0 +1,45 @@
+---
+- name: Verify gpg-agent is running
+ ansible.builtin.command:
+ cmd: gpg-agent --version
+ changed_when: false
+ register: ssh_gpg_agent_check
+ failed_when: ssh_gpg_agent_check.rc != 0
+
+- name: Ensure .ssh directory exists
+ ansible.builtin.file:
+ path: "{{ ansible_facts['user_dir'] }}/.ssh"
+ state: directory
+ mode: "0700"
+
+- name: Write ansible SSH private key
+ ansible.builtin.copy:
+ content: "{{ lookup('pipe', 'pass show ssh/id_ed25519_ansible') }}\n"
+ dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible"
+ mode: "0600"
+ no_log: true
+
+- name: Derive and write ansible SSH public key
+ ansible.builtin.shell:
+ cmd: ssh-keygen -y -f {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible > {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible.pub
+ changed_when: false
+
+- name: Deploy SSH config
+ ansible.builtin.template:
+ src: config.j2
+ dest: "{{ ansible_facts['user_dir'] }}/.ssh/config"
+ mode: "0600"
+
+- name: Fetch Gitea host key
+ ansible.builtin.command:
+ cmd: ssh-keyscan -4 -p 2222 gitea.learningunix.net
+ register: ssh_gitea_host_key
+ changed_when: false
+
+- name: Add Gitea host key to known_hosts
+ ansible.builtin.known_hosts:
+ name: "[gitea.learningunix.net]:2222"
+ key: "{{ item }}"
+ path: "{{ ansible_facts['user_dir'] }}/.ssh/known_hosts"
+ state: present
+ loop: "{{ ssh_gitea_host_key.stdout_lines }}"
diff --git a/roles/ssh/templates/config.j2 b/roles/ssh/templates/config.j2
@@ -0,0 +1,9 @@
+Host gitea.learningunix.net
+ User git
+ Port 2222
+ IdentityFile ~/.ssh/id_ed25519_ansible
+
+Host learningunix
+ HostName 91.99.74.227
+ User cjr
+ IdentityFile ~/.ssh/id_ed25519
diff --git a/site.yml b/site.yml
@@ -23,6 +23,10 @@
connection: local
roles:
+ - role: ssh
+ tags: ssh
+ - role: pass
+ tags: pass
- role: dotfiles
tags: dotfiles
- role: scripts
