tegwick
30a3f908aa
Establishes a dedicated SSH keypair for the Custodian automation agent: - ansible/roles/custodian_agent/: authorized_key task (tagged custodian_agent) - ansible/inventory/group_vars/all.yaml: custodian_agent_user/pubkey vars - ansible/playbooks/bootstrap.yaml: custodian_agent role added - Makefile: provision-custodian-agent / provision-custodian-agent-host targets Keypair generation: cd ~/the-custodian && make custodian-keygen Then deploy: cd ~/railiance-infra && make provision-custodian-agent The private key lives at ~/.ssh/id_custodian_agent — never committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
48 lines
1.9 KiB
YAML
48 lines
1.9 KiB
YAML
---
|
|
# custodian_agent role — injects the Custodian automation SSH identity
|
|
#
|
|
# What it does:
|
|
# - Ensures the target user (custodian_agent_user) exists
|
|
# - Adds custodian_agent_pubkey to that user's authorized_keys
|
|
# - Restricts the key: no X11, no port-forward, no pty for non-interactive use
|
|
#
|
|
# Variables (set in group_vars/all.yaml or pass via --extra-vars):
|
|
# custodian_agent_user: user account the key is added to (default: tegwick)
|
|
# custodian_agent_pubkey: the public key string (required, set in all.yaml)
|
|
#
|
|
# The private key lives on the workstation at ~/.ssh/id_custodian_agent.
|
|
# It is NEVER committed to any repository.
|
|
|
|
- name: Ensure target user exists
|
|
tags: [custodian_agent]
|
|
ansible.builtin.user:
|
|
name: "{{ custodian_agent_user | default('tegwick') }}"
|
|
state: present
|
|
shell: /bin/bash
|
|
create_home: true
|
|
|
|
- name: Ensure .ssh directory exists for target user
|
|
tags: [custodian_agent]
|
|
ansible.builtin.file:
|
|
path: "/home/{{ custodian_agent_user | default('tegwick') }}/.ssh"
|
|
state: directory
|
|
owner: "{{ custodian_agent_user | default('tegwick') }}"
|
|
group: "{{ custodian_agent_user | default('tegwick') }}"
|
|
mode: '0700'
|
|
|
|
- name: Add custodian agent public key to authorized_keys
|
|
tags: [custodian_agent]
|
|
ansible.posix.authorized_key:
|
|
user: "{{ custodian_agent_user | default('tegwick') }}"
|
|
key: "{{ custodian_agent_pubkey }}"
|
|
key_options: "no-X11-forwarding,no-agent-forwarding"
|
|
comment: "custodian-agent@{{ inventory_hostname }}"
|
|
state: present
|
|
when: custodian_agent_pubkey is defined and custodian_agent_pubkey | length > 0
|
|
|
|
- name: Warn if custodian_agent_pubkey is not set
|
|
tags: [custodian_agent]
|
|
ansible.builtin.debug:
|
|
msg: "WARNING: custodian_agent_pubkey is not set — skipping authorized_keys injection"
|
|
when: custodian_agent_pubkey is not defined or custodian_agent_pubkey | length == 0
|