From 56795d3b666d6d68ead81bf75db1428862dfdc45 Mon Sep 17 00:00:00 2001
From: jaydee <jaydee@sectorq.eu>
Date: Thu, 28 May 2026 12:03:12 +0200
Subject: [PATCH] build-all

---
 roles/init/tasks/RedHat.yml | 171 ++++++++++++++++++++++++++++++++++++
 1 file changed, 171 insertions(+)
 create mode 100644 roles/init/tasks/RedHat.yml

diff --git a/roles/init/tasks/RedHat.yml b/roles/init/tasks/RedHat.yml
new file mode 100644
index 0000000..e41c959
--- /dev/null
+++ b/roles/init/tasks/RedHat.yml
@@ -0,0 +1,171 @@
+- name: Init Rocky
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  block:
+    - name: Install required dependencies
+      ansible.builtin.dnf:
+        name:
+          - dnf-plugins-core
+          - curl
+        state: present
+
+    - name: Add HashiCorp repository
+      ansible.builtin.get_url:
+        url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
+        dest: /etc/yum.repos.d/hashicorp.repo
+        mode: "0644"
+
+    - name: Clean DNF cache
+      ansible.builtin.command: dnf clean all
+      changed_when: false
+
+    - name: Install Vault
+      ansible.builtin.dnf:
+        name: vault
+        state: present
+        update_cache: yes
+
+    - name: Set vault address
+      copy:
+        dest: /etc/profile.d/vault.sh
+        content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Read SSH CA public key from Vault
+      ansible.builtin.command:
+        cmd: vault read -field=public_key ssh/config/ca
+      register: vault_ca
+      changed_when: false
+      environment:
+        VAULT_ADDR: "{{ vault_addr }}"
+        VAULT_TOKEN: "{{ vault_token }}"
+
+    - name: Install trusted SSH user CA
+      ansible.builtin.copy:
+        content: "{{ vault_ca.stdout }}\n"
+        dest: /etc/ssh/trusted-user-ca-keys.pem
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable Trusted User CA
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^TrustedUserCAKeys"
+        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
+        state: present
+
+    - name: Enable PubkeyAuthentication
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PubkeyAuthentication.*"
+        line: "PubkeyAuthentication yes"
+        state: present
+
+    - name: Create vault agent dir
+      file:
+        path: /etc/vault-agent
+        state: directory
+        owner: root
+        group: root
+        mode: '0644'
+    
+    - name: Create vault agent config
+      copy:
+        dest: /etc/vault-agent/config.hcl
+        content: |
+          vault {
+            address = "http://vault.home.lan:8205"
+          }
+
+          auto_auth {
+            method "approle" {
+              mount_path = "auth/approle"
+
+              config = {
+                role_id_file_path   = "/etc/vault-agent/role_id"
+                secret_id_file_path = "/etc/vault-agent/secret_id"
+                remove_secret_id_file_after_reading = false
+              }
+            }
+
+            sink "file" {
+              config = {
+                path = "/tmp/vault-token"
+              }
+            }
+          }
+
+          template {
+            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
+            perms = "0644"
+            user = "jd"
+            group = "jd"
+            contents = <<EOH
+            {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{  '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
+            EOH
+          }
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Create file with token for vault agent
+      copy:
+        dest: /etc/vault-agent/token
+        content: "{{ vault_sshcert_token }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create file with role_id for vault agent
+      copy:
+        dest: /etc/vault-agent/role_id
+        content: "{{ vault_ssh_client_role_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+        
+    - name: Create file with secret_id for vault agent
+      copy:
+        dest: /etc/vault-agent/secret_id
+        content: "{{ vault_ssh_client_secret_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create service for vault agent
+      copy:
+        dest: /etc/systemd/system/vault-agent.service
+        content: |
+          [Unit]
+          Description=Vault Agent
+          After=network-online.target
+
+          [Service]
+          ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
+          Restart=always
+          User=root
+          Group=root
+
+          [Install]
+          WantedBy=multi-user.target
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable and start vault agent service
+      systemd:
+        name: vault-agent
+        enabled: yes
+        state: started
+        
+    - name: Restart sshd
+      ansible.builtin.service:
+        name: sshd
+        state: restarted
+
+    - name: Sync time
+      ansible.builtin.command:
+        cmd: chronyc makestep
+      changed_when: false
\ No newline at end of file