build

roles/vault_ssh_keys/tasks/main.yml

@@ -7,6 +7,7 @@
     - name: Facts
       ansible.builtin.setup:
       when: ansible_facts.architecture is not defined
+
     - name: Install dependencies
       apt:
         name:
@@ -117,8 +118,11 @@
         mode: '0644'
     
     - name: Create vault agent config
-      copy:
+      ansible.builtin.copy:
         dest: /etc/vault-agent/config.hcl
+        owner: root
+        group: root
+        mode: '0644'
         content: |
           vault {
             address = "http://vault.home.lan:8205"
@@ -142,32 +146,32 @@
             }
           }
 
-
           template {
             destination = "/home/jd/.ssh/id_ed25519-cert.pub"
             perms       = "0644"
             user        = "jd"
             group       = "jd"
+
             contents = <<EOH
-          {{ '{{' }} with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}' }}
+          {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" -{{ '}}' }}
           {{ '{{' }} .Data.signed_key {{ '}}' }}
-          {{ '{{' }} end {{ '}}' }}
+          {{ '{{' }}- end -{{ '}}' }}
           EOH
           }
+
           template {
             destination = "/home/ansible/.ssh/id_ed25519-cert.pub"
             perms       = "0644"
             user        = "ansible"
             group       = "ansible"
+
             contents = <<EOH
-          {{ '{{' }} with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/ansible/.ssh/id_ed25519.pub"))) "valid_principals=ansible" {{ '}}' }}
+          {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/ansible/.ssh/id_ed25519.pub"))) "valid_principals=ansible" -{{ '}}' }}
           {{ '{{' }} .Data.signed_key {{ '}}' }}
-          {{ '{{' }} end {{ '}}' }}
+          {{ '{{' }}- end -{{ '}}' }}
           EOH
           }
-        owner: root
+
-        group: root
-        mode: '0644'
 
     - name: Create secret id file
       copy: