diff --git a/init.yml b/init.yml
index e112801..a8d9d64 100644
--- a/init.yml
+++ b/init.yml
@@ -1,8 +1,14 @@
 $ANSIBLE_VAULT;1.1;AES256
-61313034323034346462383763613135666538616137323835393031366337616136386536383666
-6365353735656131353463623530333861613937363238320a626230646430343666353062323636
-64303835663431363730383763643264373466366237653362623861633933656161383632636164
-3263616535366366320a656334303338636665623230306562383034393264336161373635633762
-33646530386132643430356465646366346536666136396331363264393162626161396535333834
-61613664666365323462383332623934623135623563363030663961636438393136313661373034
-663261616462663134323731373830366365
+37376436636363643032623234396230623134633462626161383931633461623463356263663061
+3363336364373538636236613037653336623437646434660a366464323232663632663864393566
+31346635656461306231613331376334313962626331613631343835663836643033383030623165
+3932616339626462310a333633393739616133383232333239346263393135353338373763376530
+31303333663237333365373163633639653830386234623534643864313134356236386464336663
+37393630613436636432643163363266343165653238663365386261346261343137306230653863
+32326461623733373636623065313132616161636239393731373965373165356636303638366662
+32613139333066613337383035323264336431633233316463343061333533663436613434613463
+65393435626665303232306261373961393938336530373761613366646234333564643432376561
+35663763653838636630653863346239373439343834343764373630643965626361363733343333
+39346637326436373965653333336332633037646439343037623835373533303962633632346162
+65376532356337636466633863356165613363303861653231353736643939643166626364613061
+6530
diff --git a/roles/init/tasks/main.yml b/roles/init/tasks/main.yml
index 7fd5e5e..7b9c561 100755
--- a/roles/init/tasks/main.yml
+++ b/roles/init/tasks/main.yml
@@ -102,4 +102,69 @@
         content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
         owner: root
         group: root
-        mode: '0440'
\ No newline at end of file
+        mode: '0644'
+
+    - name: Enable Trusted User CA
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^TrustedUserCAKeys"
+        line: "TrustedUserCAKeys /etc/ssh/trusted_user_ca.pub"
+        state: present
+
+    - name: Enable PubkeyAuthentication
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PubkeyAuthentication.*"
+        line: "PubkeyAuthentication yes"
+        state: present
+
+    - name: Create vault agent dir
+      file:
+        path: /etc/vault-agent
+        state: directory
+        owner: root
+        group: root
+        mode: '0644'
+    
+    - name: Create vault agent config
+      copy:
+        dest: /etc/vault-agent/config.hcl
+        content: |
+          vault {
+            address = "http://vault.home.lan:8205"
+          }
+
+          auto_auth {
+            method "token_file" {
+              config = {
+                token_file_path = "/etc/vault-agent/token"
+              }
+            }
+
+            sink "file" {
+              config = {
+                path = "/tmp/vault-token"
+              }
+            }
+          }
+
+          template {
+            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
+
+            contents = <<EOH
+          {{ with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" }}
+          {{ .Data.signed_key }}
+          {{ end }}
+          EOH
+          }
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Create file with token for vault agent
+      copy:
+        dest: /etc/vault-agent/token
+        content: "{{ vault_sshcert_token }}"
+        owner: root
+        group: root
+        mode: '0600'
\ No newline at end of file