build

hosts_roles.yml

@@ -67,18 +67,6 @@ datacenter:
         ansible_winrm_kerberos_delegation: true
     mqtt_srv:
       children:
-        servers1:
-          hosts:
-            rpi5-1.home.lan:
-            rpi5.home.lan:
-            omv.home.lan:
-            rack.home.lan:
-            m-server.home.lan:
-            amd.home.lan:
-          vars:
-            ansible_python_interpreter: /usr/bin/python3
-            ansible_ssh_user: jd
-            identity_file: ssh_key.pem
         nas:
           hosts:
             nas.home.lan:
@@ -125,7 +113,6 @@ datacenter:
             srv:
               hosts:
                 rpi5.home.lan:
-                m-server.home.lan:
               vars:
                 ansible_python_interpreter: /usr/bin/python3
                 ansible_ssh_user: jd
@@ -147,6 +134,8 @@ datacenter:
           vars:
             ansible_python_interpreter: /usr/bin/python3
             ansible_ssh_user: jd
+            ansible_ssh_password: l4c1j4yd33Du5lo
+            ansible_become_password: l4c1j4yd33Du5lo
         nas:
           hosts:
             nas.home.lan:
@@ -165,8 +154,8 @@ datacenter:
           vars:
             ansible_python_interpreter: /usr/bin/python3
             ansible_ssh_user: ansible
-            ansible_ssh_pass: q
+            ansible_ssh_pass: l4c1j4yd33Du5lo
-            ansible_become_password: q
+            ansible_become_password: l4c1j4yd33Du5lo
             ansible_become_user: root
             ansible_user: ansible
     vms:

jaydee.yml

@@ -1,55 +1,55 @@
 $ANSIBLE_VAULT;1.1;AES256
-36343061373466366264313064303364653234633565386666333861643137376430623931666135
+37363138343662313066323164666662393363383533303231313463663930373361346537373832
-6137316563613135353437376136626136646230326532320a313435396536363261613837643032
+3039383933613366626134663231636339626237306632640a373565623931613261376666626137
-64313231336432656237613130613163383062653431383336383365353039313031383136386461
+35626538623238326234303062353536623861623632363233613434323466343466396136663536
-3562313663313138350a626331383662653963396434666365653561396537653037383531653630
+3364353038643163320a613135353638366635313066396538643965303334356135383063373061
-61333932353635373365643438646562626339323065333837363139623861653236343764373236
+66373339613336343231356462353433373630326233366433613964363831373837366262363965
-38663335336233396661366263383333646532366565313563303737376263633161333161356339
+63633235356639333631616635316236636536306630633134306630313430643035353966343762
-33626434626230346637323433386462623165646634333965663061323865646239353261373161
+62656232353462346234373361613437666139656162663462643938356631663438366234623266
-39353536323432346233333035326361333066653961313064663062353833663963303366303339
+62313831383833623937643730356430346436383261633430663663653037383533366632333664
-34656165643935633033313237373833393065653064306264393131333562633530616663313034
+61383963643463643738653630663761653361323630313231306433303037303434393534643833
-61316335626165303833383061656338306237396534303332626665626336393333623037633039
+30663063316535626534346131393161396132343436623833336533613666643832383939646631
-65326439333037366635366637346632643864616136626163376237626232386531646134313033
+34643337623065653636366536383631386331633334383136343731383332353863343338613136
-34326134303366336362373136653237613538653738636532393633613531646238363266653962
+66633034666165633335636132356666393733633136623933656161653461653865663632646136
-31333430636230653437646664316438303936656236343162366666623964653863663634383230
+36393766626634383365346231333830633533313936313038616566383064633366666139313636
-37393034326166343238626265666136663964623835393132323132383939343434323434353136
+37633062643161656266643562313035326336386333333731656161396235383038356238343737
-36346265373164313336396635343839646564636533646662396536303739636330323765376130
+33393033623335343663316666656531666132386561616437393432336663373537613739346234
-62373034373564323038303933366665356633333761326166313762613832313135343133343564
+36373133343062343938353531616366343361393066313965623664643535356434613432393730
-36303562323865373435626663363031303430353833343338626133363038393762373934663330
+30346165386362353766373865643234346334633936373566656665323832363363383863633661
-32343635386166656362323933323839326638393562386462313134393339333261326233396131
+61373938383936393034383866666461613861366639323934646637623935623066396537356363
-38653535343265346233653839363664636537386263363133396233376635313330613632393236
+33653339313937393233633364343030623734663062373365343435363237663164323362303038
-33373635376631376233356334656264326165306137383636326535626535363334303234663564
+66653661386362643239363539656266306631396230303032366335373134336536623731313238
-63396261326330663561663534376131626139393665633739326435323336396234343262313134
+64626137363366336236383161343962353963663136643062643338666461366364386239353030
-39373064346361623431383964306665636466313338323333646162333866656235333861653564
+65653239656565373739383135613163336235653435653437386134613335333939343132323030
-35633132323262303630636334653139336636316333346263616630646463643066386562323462
+64636533326230383936336338376537363533376237396333346431356466666166396232366133
-66643366356333633465333662336434393130643362323638663532646564326635346233623735
+37303161386437656135323664376263303565316163316130333866616136626163363162316133
-61636535313532353831383530343164623435653235366565386339333438323333666232366135
+33353839343237623839356236613665323031363835393537346263373732623635663463326430
-39616364323665353738633533326436656362626130353662303462356632303961393632373663
+37303938663361396162613366643664386539373965393061643066336138313062646634626234
-32336130316334633662653939633566393563663238326330336330386130373333373537333231
+63343334663835343563376664376330333566326436343134303232393161653861653635396461
-61613933393631393036363862343835613635393932636531393061326130323034333334303637
+62303561326164313636373964623165613762383261643064633039393436646637356131313865
-33643936336632393836353065366332313162653265633139613330633239653534663131396662
+65643362323934663235303032313335666436663365333636653733636432336630343236356230
-61336162666632653864396533393033346435336434316161623335373733643965363861323033
+36383839636435306664383861316635653733633834363134323639636465633061386339343737
-30363637646562373935343965666633306336626131393766656237336431363765366663623537
+64333264336436343965346164303634633864366231363262333564633864343537393730643735
-36356564613336653039623333353363363338626334366435396234653664373066346264626565
+35383536346238373135363932386464343639336134346332356430613665393539323638323433
-37343837343031633830353131333335656463353533386361653064643130316333316465383565
+35336266373337656531336133666631363136643364363561613932323831323163383130643137
-34333263633731376365303234623135663034633035353661366533373634643665353531376536
+30313137333531376430336136653538663564373737336237376162373836393530363161633436
-31363535626239633666326364383035353631393930643332636537663031313536343630396661
+37393233626365393264356163393366653564663937303037376631313264303639396165656431
-64323432663333356366356136666466333163613535343565306361336331303532613734323962
+36646131633438396631663839383936616666333266333135656339616164376630323733616334
-61646364613430643761653534363137643333356563623365616163313830373137336461363061
+66346365643833343731346535633836343232323137646535633336643033386361336233616261
-33393133373539613839353563643135356435353831663962303961663263666566383664333961
+61306661646538353534613663333662636265643361313162333263383432643839613538623630
-33666162313939623235343563643863646537333930356565616130333239323464613030633933
+30386661643963656634386564323133376263393332333964393534366565633062316532333536
-32366131626561313839363438636366363038366133396635613336343961613234626563376135
+33363937613539373635386362613137653132303466383639653136396665363632393233306637
-35356665303931333465653832343731363230396664303235333339636162626336376365663133
+30363136313835353530663831663665303565656130326365623764393166633334306166336236
-36636661363334633766663633383335316336656139376263306566316565396365653462303363
+33386665643239656362623061386631373861393139326463316133613564616462303135353665
-61656433306264646536333333633366656264313536636464633139653762643132316539633539
+64306435636333633436346636663962316332633136656333646164633065393262373364613632
-36616662613239373331623737313063333235663238616465316363363038343964336232316637
+35393530326232646166653234366433373330373138323230653639356536363864333562316463
-65303733366535323362626236623539346265666363393735313064383535663762656530313666
+62306230623333336331386630356533313939363838373937643836383036396534623861373065
-66626333656639333233326164303435336239373935326231653632383534316530343639363463
+63643232306530306530316166306565323866623263656639343561373931623563363664613462
-65363034616636303834613039363461323138313531626264346663313862656663393362313964
+64636539336338633832326361653063666231653233343333326163313439346362353330633337
-63356563303931373337646633356234623339393764636539356362623861626438663462323838
+32393463313731303835636638326134353536633135343031363464383539373465383762646132
-35323866633233326134656364363037323535633438336238313737323033323439363039353033
+30643961343330333066363539633066613666613262646564653931343130363133346537616637
-66646565653733313038653564346530646666313133336666643761326361313463616464323931
+32633162663234386436346231353135333139316536343063643938656634386662396361356464
-33373734373133336435383162373064366665636165633063616464316630316334383464663533
+35313963636264613336383130636334366337646532333836306463613065336334383239303130
-32353063356265356363666538653032623735323036366565383663373033303664633631666263
+36613239343162393464336365653333343364303962393963383935656634613963623032643165
-32386265626337373064663336613663306434666162363232306630663234373734613563316633
+35646530663934333930393435303239636538616563613130363937313438343631396337333233
-3138343765363165316635346132313961326535366265326263
+3333323536633739326464643735383136653937316465616133

roles/vault_ssh_keys/tasks/main.yml

@@ -1,9 +1,13 @@
 - name: Setup vault SSH keys
   become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
   block:
+    - name: Print become password
+      debug:
+        msg: "{{ ansible_become_password }}"
     - name: Facts
       ansible.builtin.setup:
       when: ansible_facts.architecture is not defined
+
     - name: Install dependencies
       apt:
         name:
@@ -11,19 +15,25 @@
           - unzip
           - gnupg
           - python3-debian
+          - ca-certificates
+          - gpg
         state: present
         update_cache: yes
 
-    - name: Download HashiCorp GPG key
+    - name: Download HashiCorp repository signing key
       ansible.builtin.get_url:
         url: https://apt.releases.hashicorp.com/gpg
-        dest: /tmp/hashicorp.gpg
+        dest: /tmp/hashicorp-archive-keyring.asc
+        owner: root
+        group: root
         mode: '0644'
 
-    - name: Dearmor HashiCorp GPG key
+    - name: Install HashiCorp repository signing key
-      ansible.builtin.command:
+      ansible.builtin.shell:
-        cmd: gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg /tmp/hashicorp.gpg
+        cmd: >-
-      args:
+          gpg --dearmor --yes
+          --output /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          /tmp/hashicorp-archive-keyring.asc
         creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg
 
     - name: Read os-release
@@ -41,14 +51,18 @@
     - name: Add HashiCorp APT repository
       ansible.builtin.apt_repository:
         repo: >-
-          deb [arch={{ ansible_architecture }} signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
+          deb [arch={{ 'arm64' if ansible_architecture == 'aarch64'
+          else 'amd64' if ansible_architecture == 'x86_64'
+          else ansible_architecture }}
+          signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
           https://apt.releases.hashicorp.com {{ ubuntu_codename }} main
         filename: hashicorp
         state: present
+        update_cache: false
 
-    - name: Update apt cache
+    - name: Update APT cache
       ansible.builtin.apt:
-        update_cache: yes
+        update_cache: true
 
     - name: Install Vault
       apt:
@@ -104,8 +118,11 @@
         mode: '0644'
     
     - name: Create vault agent config
-      copy:
+      ansible.builtin.copy:
         dest: /etc/vault-agent/config.hcl
+        owner: root
+        group: root
+        mode: '0644'
         content: |
           vault {
             address = "http://vault.home.lan:8205"
@@ -129,21 +146,32 @@
             }
           }
 
-
           template {
             destination = "/home/jd/.ssh/id_ed25519-cert.pub"
             perms       = "0644"
             user        = "jd"
             group       = "jd"
+
             contents = <<EOH
-          {{ '{{' }} with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{ '}}' }}
+          {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd,ansible" -{{ '}}' }}
           {{ '{{' }} .Data.signed_key {{ '}}' }}
-          {{ '{{' }} end {{ '}}' }}
+          {{ '{{' }}- end -{{ '}}' }}
           EOH
           }
-        owner: root
+
-        group: root
+          template {
-        mode: '0644'
+            destination = "/home/ansible/.ssh/id_ed25519-cert.pub"
+            perms       = "0644"
+            user        = "ansible"
+            group       = "ansible"
+
+            contents = <<EOH
+          {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/ansible/.ssh/id_ed25519.pub"))) "valid_principals=jd,ansible" -{{ '}}' }}
+          {{ '{{' }} .Data.signed_key {{ '}}' }}
+          {{ '{{' }}- end -{{ '}}' }}
+          EOH
+          }
+
 
     - name: Create secret id file
       copy: