From e81af07721274d0c2836f8aa07ac40e645b2cc70 Mon Sep 17 00:00:00 2001
From: jaydee <jaydee@sectorq.eu>
Date: Tue, 26 May 2026 23:36:52 +0200
Subject: [PATCH] build-all

---
 roles/init/tasks/Debian.yml | 193 ++++++++++++++++++++++++++++
 roles/init/tasks/Rocky.yml  | 171 ++++++++++++++++++++++++
 roles/init/tasks/common.yml | 243 +++++++++++++++++++++++++++++++++++
 roles/init/tasks/main.yml   | 250 ++----------------------------------
 4 files changed, 617 insertions(+), 240 deletions(-)
 create mode 100644 roles/init/tasks/Debian.yml
 create mode 100644 roles/init/tasks/Rocky.yml
 create mode 100755 roles/init/tasks/common.yml

diff --git a/roles/init/tasks/Debian.yml b/roles/init/tasks/Debian.yml
new file mode 100644
index 0000000..acc022c
--- /dev/null
+++ b/roles/init/tasks/Debian.yml
@@ -0,0 +1,193 @@
+- name: Init Debian
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  block:
+    - name: Ensure required packages are installed
+      ansible.builtin.apt:
+        name:
+          - gpg
+          - wget
+          - lsb-release
+        state: present
+        update_cache: true
+
+    - name: Download HashiCorp GPG key
+      ansible.builtin.get_url:
+        url: https://apt.releases.hashicorp.com/gpg
+        dest: /tmp/hashicorp.gpg
+        mode: '0644'
+
+    - name: Convert HashiCorp GPG key to keyring format
+      ansible.builtin.command:
+        cmd: >
+          gpg --dearmor
+          -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          /tmp/hashicorp.gpg
+      args:
+        creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg
+
+    - name: Add HashiCorp repository
+      ansible.builtin.apt_repository:
+        repo: >-
+          deb [arch={{ ansible_architecture == 'x86_64' | ternary('amd64', ansible_architecture) }}
+          signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
+          https://apt.releases.hashicorp.com
+          {{ ansible_distribution_release }}
+          main
+        filename: hashicorp
+        state: present
+
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+
+    - name: Install Vault
+      ansible.builtin.apt:
+        name: vault
+        state: present
+
+
+    - name: Set vault address
+      copy:
+        dest: /etc/profile.d/vault.sh
+        content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Read SSH CA public key from Vault
+      ansible.builtin.command:
+        cmd: vault read -field=public_key ssh/config/ca
+      register: vault_ca
+      changed_when: false
+      environment:
+        VAULT_ADDR: "{{ vault_addr }}"
+        VAULT_TOKEN: "{{ vault_token }}"
+
+    - name: Install trusted SSH user CA
+      ansible.builtin.copy:
+        content: "{{ vault_ca.stdout }}\n"
+        dest: /etc/ssh/trusted-user-ca-keys.pem
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable Trusted User CA
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^TrustedUserCAKeys"
+        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
+        state: present
+
+    - name: Enable PubkeyAuthentication
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PubkeyAuthentication.*"
+        line: "PubkeyAuthentication yes"
+        state: present
+
+    - name: Create vault agent dir
+      file:
+        path: /etc/vault-agent
+        state: directory
+        owner: root
+        group: root
+        mode: '0644'
+    
+    - name: Create vault agent config
+      copy:
+        dest: /etc/vault-agent/config.hcl
+        content: |
+          vault {
+            address = "http://vault.home.lan:8205"
+          }
+
+          auto_auth {
+            method "approle" {
+              mount_path = "auth/approle"
+
+              config = {
+                role_id_file_path   = "/etc/vault-agent/role_id"
+                secret_id_file_path = "/etc/vault-agent/secret_id"
+                remove_secret_id_file_after_reading = false
+              }
+            }
+
+            sink "file" {
+              config = {
+                path = "/tmp/vault-token"
+              }
+            }
+          }
+
+          template {
+            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
+            perms = "0644"
+            user = "jd"
+            group = "jd"
+            contents = <<EOH
+            {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{  '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
+            EOH
+          }
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Create file with token for vault agent
+      copy:
+        dest: /etc/vault-agent/token
+        content: "{{ vault_sshcert_token }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create file with role_id for vault agent
+      copy:
+        dest: /etc/vault-agent/role_id
+        content: "{{ vault_ssh_client_role_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+        
+    - name: Create file with secret_id for vault agent
+      copy:
+        dest: /etc/vault-agent/secret_id
+        content: "{{ vault_ssh_client_secret_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create service for vault agent
+      copy:
+        dest: /etc/systemd/system/vault-agent.service
+        content: |
+          [Unit]
+          Description=Vault Agent
+          After=network-online.target
+
+          [Service]
+          ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
+          Restart=always
+          User=root
+          Group=root
+
+          [Install]
+          WantedBy=multi-user.target
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable and start vault agent service
+      systemd:
+        name: vault-agent
+        enabled: yes
+        state: started
+        
+    - name: Restart sshd
+      ansible.builtin.service:
+        name: sshd
+        state: restarted
+
+    - name: Sync time
+      ansible.builtin.command:
+        cmd: chronyc makestep
+      changed_when: false
\ No newline at end of file
diff --git a/roles/init/tasks/Rocky.yml b/roles/init/tasks/Rocky.yml
new file mode 100644
index 0000000..c3ebf90
--- /dev/null
+++ b/roles/init/tasks/Rocky.yml
@@ -0,0 +1,171 @@
+- name: Init
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  block:
+    - name: Install required dependencies
+      ansible.builtin.dnf:
+        name:
+          - dnf-plugins-core
+          - curl
+        state: present
+
+    - name: Add HashiCorp repository
+      ansible.builtin.get_url:
+        url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
+        dest: /etc/yum.repos.d/hashicorp.repo
+        mode: "0644"
+
+    - name: Clean DNF cache
+      ansible.builtin.command: dnf clean all
+      changed_when: false
+
+    - name: Install Vault
+      ansible.builtin.dnf:
+        name: vault
+        state: present
+        update_cache: yes
+
+    - name: Set vault address
+      copy:
+        dest: /etc/profile.d/vault.sh
+        content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Read SSH CA public key from Vault
+      ansible.builtin.command:
+        cmd: vault read -field=public_key ssh/config/ca
+      register: vault_ca
+      changed_when: false
+      environment:
+        VAULT_ADDR: "{{ vault_addr }}"
+        VAULT_TOKEN: "{{ vault_token }}"
+
+    - name: Install trusted SSH user CA
+      ansible.builtin.copy:
+        content: "{{ vault_ca.stdout }}\n"
+        dest: /etc/ssh/trusted-user-ca-keys.pem
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable Trusted User CA
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^TrustedUserCAKeys"
+        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
+        state: present
+
+    - name: Enable PubkeyAuthentication
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PubkeyAuthentication.*"
+        line: "PubkeyAuthentication yes"
+        state: present
+
+    - name: Create vault agent dir
+      file:
+        path: /etc/vault-agent
+        state: directory
+        owner: root
+        group: root
+        mode: '0644'
+    
+    - name: Create vault agent config
+      copy:
+        dest: /etc/vault-agent/config.hcl
+        content: |
+          vault {
+            address = "http://vault.home.lan:8205"
+          }
+
+          auto_auth {
+            method "approle" {
+              mount_path = "auth/approle"
+
+              config = {
+                role_id_file_path   = "/etc/vault-agent/role_id"
+                secret_id_file_path = "/etc/vault-agent/secret_id"
+                remove_secret_id_file_after_reading = false
+              }
+            }
+
+            sink "file" {
+              config = {
+                path = "/tmp/vault-token"
+              }
+            }
+          }
+
+          template {
+            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
+            perms = "0644"
+            user = "jd"
+            group = "jd"
+            contents = <<EOH
+            {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{  '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
+            EOH
+          }
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Create file with token for vault agent
+      copy:
+        dest: /etc/vault-agent/token
+        content: "{{ vault_sshcert_token }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create file with role_id for vault agent
+      copy:
+        dest: /etc/vault-agent/role_id
+        content: "{{ vault_ssh_client_role_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+        
+    - name: Create file with secret_id for vault agent
+      copy:
+        dest: /etc/vault-agent/secret_id
+        content: "{{ vault_ssh_client_secret_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create service for vault agent
+      copy:
+        dest: /etc/systemd/system/vault-agent.service
+        content: |
+          [Unit]
+          Description=Vault Agent
+          After=network-online.target
+
+          [Service]
+          ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
+          Restart=always
+          User=root
+          Group=root
+
+          [Install]
+          WantedBy=multi-user.target
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable and start vault agent service
+      systemd:
+        name: vault-agent
+        enabled: yes
+        state: started
+        
+    - name: Restart sshd
+      ansible.builtin.service:
+        name: sshd
+        state: restarted
+
+    - name: Sync time
+      ansible.builtin.command:
+        cmd: chronyc makestep
+      changed_when: false
\ No newline at end of file
diff --git a/roles/init/tasks/common.yml b/roles/init/tasks/common.yml
new file mode 100755
index 0000000..2822022
--- /dev/null
+++ b/roles/init/tasks/common.yml
@@ -0,0 +1,243 @@
+- name: Init
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  block:
+    
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: init.yml
+    - name: Change password for jd
+      ansible.builtin.user:
+        name: jd
+        password: "{{ jd_password | password_hash('sha512') }}"
+    - name: "Ensure sudo binary  exist"
+      stat:
+        path: /usr/bin/sudo
+      register: sudo_binary
+    - name: "Install sudo if not present"
+      package:
+        name: sudo
+        state: present
+      when: not sudo_binary.stat.exists
+    
+    - name: Check if group exists
+      getent:
+        database: group
+        key: sudo
+      register: group_check
+      ignore_errors: true
+      
+    - name: Ensure deploy user exists
+      ansible.builtin.user:
+        name: jd
+        shell: /bin/bash
+        groups: sudo
+        append: true
+      when: group_check is succeeded
+    - name: Ensure directory sudoers.d exists
+      file:
+        path: /etc/sudoers.d
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+  
+    - name: Give jd passwordless sudo
+      copy:
+        dest: /etc/sudoers.d/jd
+        content: "jd ALL=(ALL) NOPASSWD:ALL\n"
+        owner: root
+        group: root
+        mode: '0440'
+
+    - name: Change password for root
+      ansible.builtin.user:
+        name: root
+        password: "{{ jd_password | password_hash('sha512') }}"
+
+    - name: Update become password for subsequent tasks
+      ansible.builtin.set_fact:
+        ansible_become_password: "{{ jd_password }}"
+
+    - name: Set timezone to Europe/Bratislava
+      ansible.builtin.command:
+        cmd: timedatectl set-timezone Europe/Bratislava
+      args:
+        creates: /etc/timezone
+    - name: Set hostname
+      ansible.builtin.hostname:
+        name: "{{ inventory_hostname }}"
+    - name: Add host entry to /etc/hosts
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        regexp: "^127.0.0.1 .*"
+        line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
+        state: present
+
+    - name: Install required dependencies
+      ansible.builtin.dnf:
+        name:
+          - dnf-plugins-core
+          - curl
+        state: present
+
+    - name: Add HashiCorp repository
+      ansible.builtin.get_url:
+        url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
+        dest: /etc/yum.repos.d/hashicorp.repo
+        mode: "0644"
+
+    - name: Clean DNF cache
+      ansible.builtin.command: dnf clean all
+      changed_when: false
+
+    - name: Install Vault
+      ansible.builtin.dnf:
+        name: vault
+        state: present
+        update_cache: yes
+
+    - name: Set vault address
+      copy:
+        dest: /etc/profile.d/vault.sh
+        content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Read SSH CA public key from Vault
+      ansible.builtin.command:
+        cmd: vault read -field=public_key ssh/config/ca
+      register: vault_ca
+      changed_when: false
+      environment:
+        VAULT_ADDR: "{{ vault_addr }}"
+        VAULT_TOKEN: "{{ vault_token }}"
+
+    - name: Install trusted SSH user CA
+      ansible.builtin.copy:
+        content: "{{ vault_ca.stdout }}\n"
+        dest: /etc/ssh/trusted-user-ca-keys.pem
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable Trusted User CA
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^TrustedUserCAKeys"
+        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
+        state: present
+
+    - name: Enable PubkeyAuthentication
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^PubkeyAuthentication.*"
+        line: "PubkeyAuthentication yes"
+        state: present
+
+    - name: Create vault agent dir
+      file:
+        path: /etc/vault-agent
+        state: directory
+        owner: root
+        group: root
+        mode: '0644'
+    
+    - name: Create vault agent config
+      copy:
+        dest: /etc/vault-agent/config.hcl
+        content: |
+          vault {
+            address = "http://vault.home.lan:8205"
+          }
+
+          auto_auth {
+            method "approle" {
+              mount_path = "auth/approle"
+
+              config = {
+                role_id_file_path   = "/etc/vault-agent/role_id"
+                secret_id_file_path = "/etc/vault-agent/secret_id"
+                remove_secret_id_file_after_reading = false
+              }
+            }
+
+            sink "file" {
+              config = {
+                path = "/tmp/vault-token"
+              }
+            }
+          }
+
+          template {
+            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
+            perms = "0644"
+            user = "jd"
+            group = "jd"
+            contents = <<EOH
+            {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{  '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
+            EOH
+          }
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Create file with token for vault agent
+      copy:
+        dest: /etc/vault-agent/token
+        content: "{{ vault_sshcert_token }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create file with role_id for vault agent
+      copy:
+        dest: /etc/vault-agent/role_id
+        content: "{{ vault_ssh_client_role_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+        
+    - name: Create file with secret_id for vault agent
+      copy:
+        dest: /etc/vault-agent/secret_id
+        content: "{{ vault_ssh_client_secret_id }}"
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Create service for vault agent
+      copy:
+        dest: /etc/systemd/system/vault-agent.service
+        content: |
+          [Unit]
+          Description=Vault Agent
+          After=network-online.target
+
+          [Service]
+          ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
+          Restart=always
+          User=root
+          Group=root
+
+          [Install]
+          WantedBy=multi-user.target
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Enable and start vault agent service
+      systemd:
+        name: vault-agent
+        enabled: yes
+        state: started
+        
+    - name: Restart sshd
+      ansible.builtin.service:
+        name: sshd
+        state: restarted
+
+    - name: Sync time
+      ansible.builtin.command:
+        cmd: chronyc makestep
+      changed_when: false
\ No newline at end of file
diff --git a/roles/init/tasks/main.yml b/roles/init/tasks/main.yml
index 2822022..9b4d5d2 100755
--- a/roles/init/tasks/main.yml
+++ b/roles/init/tasks/main.yml
@@ -1,243 +1,13 @@
-- name: Init
-  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
-  block:
+- name: Include vault
+  ansible.builtin.include_vars:
+    file: jaydee.yml
     
-    - name: Include vault
-      ansible.builtin.include_vars:
-        file: init.yml
-    - name: Change password for jd
-      ansible.builtin.user:
-        name: jd
-        password: "{{ jd_password | password_hash('sha512') }}"
-    - name: "Ensure sudo binary  exist"
-      stat:
-        path: /usr/bin/sudo
-      register: sudo_binary
-    - name: "Install sudo if not present"
-      package:
-        name: sudo
-        state: present
-      when: not sudo_binary.stat.exists
-    
-    - name: Check if group exists
-      getent:
-        database: group
-        key: sudo
-      register: group_check
-      ignore_errors: true
-      
-    - name: Ensure deploy user exists
-      ansible.builtin.user:
-        name: jd
-        shell: /bin/bash
-        groups: sudo
-        append: true
-      when: group_check is succeeded
-    - name: Ensure directory sudoers.d exists
-      file:
-        path: /etc/sudoers.d
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
-  
-    - name: Give jd passwordless sudo
-      copy:
-        dest: /etc/sudoers.d/jd
-        content: "jd ALL=(ALL) NOPASSWD:ALL\n"
-        owner: root
-        group: root
-        mode: '0440'
+- name: Facts
+  ansible.builtin.setup:
+  when: ansible_facts.architecture is not defined
 
-    - name: Change password for root
-      ansible.builtin.user:
-        name: root
-        password: "{{ jd_password | password_hash('sha512') }}"
+- name: Include common tasks
+  ansible.builtin.include_tasks: common.yml"
 
-    - name: Update become password for subsequent tasks
-      ansible.builtin.set_fact:
-        ansible_become_password: "{{ jd_password }}"
-
-    - name: Set timezone to Europe/Bratislava
-      ansible.builtin.command:
-        cmd: timedatectl set-timezone Europe/Bratislava
-      args:
-        creates: /etc/timezone
-    - name: Set hostname
-      ansible.builtin.hostname:
-        name: "{{ inventory_hostname }}"
-    - name: Add host entry to /etc/hosts
-      ansible.builtin.lineinfile:
-        path: /etc/hosts
-        regexp: "^127.0.0.1 .*"
-        line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
-        state: present
-
-    - name: Install required dependencies
-      ansible.builtin.dnf:
-        name:
-          - dnf-plugins-core
-          - curl
-        state: present
-
-    - name: Add HashiCorp repository
-      ansible.builtin.get_url:
-        url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
-        dest: /etc/yum.repos.d/hashicorp.repo
-        mode: "0644"
-
-    - name: Clean DNF cache
-      ansible.builtin.command: dnf clean all
-      changed_when: false
-
-    - name: Install Vault
-      ansible.builtin.dnf:
-        name: vault
-        state: present
-        update_cache: yes
-
-    - name: Set vault address
-      copy:
-        dest: /etc/profile.d/vault.sh
-        content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Read SSH CA public key from Vault
-      ansible.builtin.command:
-        cmd: vault read -field=public_key ssh/config/ca
-      register: vault_ca
-      changed_when: false
-      environment:
-        VAULT_ADDR: "{{ vault_addr }}"
-        VAULT_TOKEN: "{{ vault_token }}"
-
-    - name: Install trusted SSH user CA
-      ansible.builtin.copy:
-        content: "{{ vault_ca.stdout }}\n"
-        dest: /etc/ssh/trusted-user-ca-keys.pem
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Enable Trusted User CA
-      ansible.builtin.lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: "^TrustedUserCAKeys"
-        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
-        state: present
-
-    - name: Enable PubkeyAuthentication
-      ansible.builtin.lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: "^PubkeyAuthentication.*"
-        line: "PubkeyAuthentication yes"
-        state: present
-
-    - name: Create vault agent dir
-      file:
-        path: /etc/vault-agent
-        state: directory
-        owner: root
-        group: root
-        mode: '0644'
-    
-    - name: Create vault agent config
-      copy:
-        dest: /etc/vault-agent/config.hcl
-        content: |
-          vault {
-            address = "http://vault.home.lan:8205"
-          }
-
-          auto_auth {
-            method "approle" {
-              mount_path = "auth/approle"
-
-              config = {
-                role_id_file_path   = "/etc/vault-agent/role_id"
-                secret_id_file_path = "/etc/vault-agent/secret_id"
-                remove_secret_id_file_after_reading = false
-              }
-            }
-
-            sink "file" {
-              config = {
-                path = "/tmp/vault-token"
-              }
-            }
-          }
-
-          template {
-            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
-            perms = "0644"
-            user = "jd"
-            group = "jd"
-            contents = <<EOH
-            {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{  '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
-            EOH
-          }
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Create file with token for vault agent
-      copy:
-        dest: /etc/vault-agent/token
-        content: "{{ vault_sshcert_token }}"
-        owner: root
-        group: root
-        mode: '0600'
-
-    - name: Create file with role_id for vault agent
-      copy:
-        dest: /etc/vault-agent/role_id
-        content: "{{ vault_ssh_client_role_id }}"
-        owner: root
-        group: root
-        mode: '0600'
-        
-    - name: Create file with secret_id for vault agent
-      copy:
-        dest: /etc/vault-agent/secret_id
-        content: "{{ vault_ssh_client_secret_id }}"
-        owner: root
-        group: root
-        mode: '0600'
-
-    - name: Create service for vault agent
-      copy:
-        dest: /etc/systemd/system/vault-agent.service
-        content: |
-          [Unit]
-          Description=Vault Agent
-          After=network-online.target
-
-          [Service]
-          ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
-          Restart=always
-          User=root
-          Group=root
-
-          [Install]
-          WantedBy=multi-user.target
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Enable and start vault agent service
-      systemd:
-        name: vault-agent
-        enabled: yes
-        state: started
-        
-    - name: Restart sshd
-      ansible.builtin.service:
-        name: sshd
-        state: restarted
-
-    - name: Sync time
-      ansible.builtin.command:
-        cmd: chronyc makestep
-      changed_when: false
\ No newline at end of file
+- name: Include OS-specific tasks
+  ansible.builtin.include_tasks: "{{ ansible_facts.os_family }}.yml"
\ No newline at end of file