Archive Legacy Setup And Add Ansible Control Plane

2026-07-08 12:47:37 +03:00
parent 841d56380b
commit 4bafa7d09e
203 changed files with 1663 additions and 11 deletions
@@ -0,0 +1,38 @@
+- name: Bootstrap Ansible service account
+  hosts: shell_hosts
+  gather_facts: true
+  become: true
+  vars:
+    ansible_service_user: ansible
+    ansible_service_public_key_file: ~/.ssh/id_ed25519_homelab_ansible.pub
+    ansible_service_sudoers_file: /etc/sudoers.d/99-ansible-service-user
+
+  tasks:
+    - name: Read local Ansible service public key
+      ansible.builtin.set_fact:
+        ansible_service_public_key: "{{ lookup('file', ansible_service_public_key_file) }}"
+      delegate_to: localhost
+      become: false
+
+    - name: Ensure Ansible service user exists
+      ansible.builtin.user:
+        name: "{{ ansible_service_user }}"
+        shell: /bin/bash
+        create_home: true
+        state: present
+
+    - name: Install Ansible service SSH key
+      ansible.posix.authorized_key:
+        user: "{{ ansible_service_user }}"
+        key: "{{ ansible_service_public_key }}"
+        state: present
+        exclusive: true
+
+    - name: Allow passwordless sudo for Ansible service user
+      ansible.builtin.copy:
+        dest: "{{ ansible_service_sudoers_file }}"
+        owner: root
+        group: root
+        mode: "0440"
+        content: "{{ ansible_service_user }} ALL=(ALL) NOPASSWD: ALL\n"
+        validate: /usr/sbin/visudo -cf %s