Rename the role entrypoints to main.yaml

prepare-server/roles/common/tasks/main.yaml

@@ -0,0 +1,51 @@
+---
+# Tasks for the common role.
+#
+# Runs in the second play, against the account the server was prepared for
+# ({{ user }}). The .ssh directory and the authorized_keys entries are already
+# in place by the time this runs: the user role installs them during the
+# bootstrap play, because they are what makes logging in as {{ user }} --
+# and therefore this play -- possible in the first place.
+
+- name: Update the sshd config file to disable password logins
+  ansible.builtin.replace:
+    path: /etc/ssh/sshd_config
+    regexp: "(\\s+)#PasswordAuthentication yes(\\s+.*)?$"
+    replace: "\\1PasswordAuthentication no\\2"
+    backup: true
+
+- name: Check if .ssh config file exists
+  ansible.builtin.stat:
+    path: "/home/{{ user }}/.ssh/config"
+  register: config_status
+
+- name: No need to upload the .ssh config
+  when: config_status.stat.exists
+  ansible.builtin.debug:
+    msg: No need to upload the .ssh config as it already exists.
+
+- name: Upload the .ssh config file
+  when: not config_status.stat.exists
+  ansible.builtin.template:
+    src: "files/config"
+    dest: "/home/{{ user }}/.ssh/config"
+    group: "{{ user }}"
+    owner: "{{ user }}"
+    mode: "0644"
+
+- name: Check if ed25519 key exists
+  ansible.builtin.stat:
+    path: "/home/{{ user }}/.ssh/id_ed25519"
+  register: key_status
+
+- name: No need to generate new ed25519 key
+  when: key_status.stat.exists
+  ansible.builtin.debug:
+    msg: No need to generate new ed25519 key as it already exists.
+
+- name: Generate new id_ed25519 key
+  when: not key_status.stat.exists
+  become: true
+  become_user: "{{ user }}"
+  ansible.builtin.shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ inventory_hostname }} $(date '+%Y.%m.%d')" -N ""
+  changed_when: true