build

roles/init/tasks/main.yml

@@ -102,4 +102,69 @@
         content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
         owner: root
         group: root
-        mode: '0440'
+        mode: '0644'
+
+    - name: Enable Trusted User CA
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^TrustedUserCAKeys"
+        line: "TrustedUserCAKeys /etc/ssh/trusted_user_ca.pub"
+        state: present
+
+    - name: Enable PubkeyAuthentication
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PubkeyAuthentication.*"
+        line: "PubkeyAuthentication yes"
+        state: present
+
+    - name: Create vault agent dir
+      file:
+        path: /etc/vault-agent
+        state: directory
+        owner: root
+        group: root
+        mode: '0644'
+    
+    - name: Create vault agent config
+      copy:
+        dest: /etc/vault-agent/config.hcl
+        content: |
+          vault {
+            address = "http://vault.home.lan:8205"
+          }
+
+          auto_auth {
+            method "token_file" {
+              config = {
+                token_file_path = "/etc/vault-agent/token"
+              }
+            }
+
+            sink "file" {
+              config = {
+                path = "/tmp/vault-token"
+              }
+            }
+          }
+
+          template {
+            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
+
+            contents = <<EOH
+          {{ with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" }}
+          {{ .Data.signed_key }}
+          {{ end }}
+          EOH
+          }
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Create file with token for vault agent
+      copy:
+        dest: /etc/vault-agent/token
+        content: "{{ vault_sshcert_token }}"
+        owner: root
+        group: root
+        mode: '0600'