tanshu
97d6892c83
Two plays: bootstrap as the provider account (ubuntu, over bootstrap.pem), then everything else as the user that first play just created. The split is forced rather than stylistic -- the second play logs in as that user, so its authorized_keys entry and its NOPASSWD sudoers entry both have to exist before it starts. That is why the key tasks live in the 'user' role and 'wheel' runs in the first play: move either into play 2 and it fails with an auth error or "Missing sudo password". Both accounts and both keys are variables. The inventory sits beside the playbook and is read via ansible.cfg, which Ansible picks up from the current working directory rather than the playbook's, so it has to be run from this directory. bootstrap.pem is gitignored -- it is the provider key for the host.
22 lines
1.0 KiB
YAML
22 lines
1.0 KiB
YAML
---
|
|
server: "clair"
|
|
|
|
# The account this server is being prepared for. Created by the first play,
|
|
# and the account every task after that logs in as.
|
|
user: "tanshu"
|
|
|
|
# Private key on the control node that logs in as {{ user }}. Its public key
|
|
# must be one of the keys the user role installs into authorized_keys,
|
|
# otherwise the second play has no way to connect.
|
|
user_key: "~/.ssh/id_ed25519"
|
|
|
|
# The account and key that can reach a freshly provisioned host: the
|
|
# provider's bootstrap account, which on Ubuntu cloud images is "ubuntu".
|
|
# Only the first play uses these; everything afterwards runs as {{ user }}.
|
|
bootstrap_user: "ubuntu"
|
|
bootstrap_key: "{{ playbook_dir }}/bootstrap.pem"
|
|
|
|
terminus_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK8WQHla0uCcNwmN0DUE49lbjNWa6+7A6OxrX3WEPQH0 tanshu@terminus 2023.01.08"
|
|
clair_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBeTz3weHvjJRTlBg+ovP3KfQNDvyn9mVsekAGwX1HMn tanshu@clair 2025-06-30"
|
|
anjin_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlvalE0JqKyjpEsGTgtf/N1d9QK2MgNFJib+e8O2h9M tanshu@anjin 2024.09.28"
|