Add the prepare-server playbook

Two plays: bootstrap as the provider account (ubuntu, over bootstrap.pem), then
everything else as the user that first play just created. The split is forced
rather than stylistic -- the second play logs in as that user, so its
authorized_keys entry and its NOPASSWD sudoers entry both have to exist before
it starts. That is why the key tasks live in the 'user' role and 'wheel' runs
in the first play: move either into play 2 and it fails with an auth error or
"Missing sudo password".

Both accounts and both keys are variables. The inventory sits beside the
playbook and is read via ansible.cfg, which Ansible picks up from the current
working directory rather than the playbook's, so it has to be run from this
directory. bootstrap.pem is gitignored -- it is the provider key for the host.

prepare-server/roles/common/tasks/main.yml

@@ -0,0 +1,51 @@
+---
+# Tasks for the common role.
+#
+# Runs in the second play, against the account the server was prepared for
+# ({{ user }}). The .ssh directory and the authorized_keys entries are already
+# in place by the time this runs: the user role installs them during the
+# bootstrap play, because they are what makes logging in as {{ user }} --
+# and therefore this play -- possible in the first place.
+
+- name: Update the sshd config file to disable password logins
+  ansible.builtin.replace:
+    path: /etc/ssh/sshd_config
+    regexp: "(\\s+)#PasswordAuthentication yes(\\s+.*)?$"
+    replace: "\\1PasswordAuthentication no\\2"
+    backup: true
+
+- name: Check if .ssh config file exists
+  ansible.builtin.stat:
+    path: "/home/{{ user }}/.ssh/config"
+  register: config_status
+
+- name: No need to upload the .ssh config
+  when: config_status.stat.exists
+  ansible.builtin.debug:
+    msg: No need to upload the .ssh config as it already exists.
+
+- name: Upload the .ssh config file
+  when: not config_status.stat.exists
+  ansible.builtin.template:
+    src: "files/config"
+    dest: "/home/{{ user }}/.ssh/config"
+    group: "{{ user }}"
+    owner: "{{ user }}"
+    mode: "0644"
+
+- name: Check if ed25519 key exists
+  ansible.builtin.stat:
+    path: "/home/{{ user }}/.ssh/id_ed25519"
+  register: key_status
+
+- name: No need to generate new ed25519 key
+  when: key_status.stat.exists
+  ansible.builtin.debug:
+    msg: No need to generate new ed25519 key as it already exists.
+
+- name: Generate new id_ed25519 key
+  when: not key_status.stat.exists
+  become: true
+  become_user: "{{ user }}"
+  ansible.builtin.shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ inventory_hostname }} $(date '+%Y.%m.%d')" -N ""
+  changed_when: true