tanshu
97d6892c83
Two plays: bootstrap as the provider account (ubuntu, over bootstrap.pem), then everything else as the user that first play just created. The split is forced rather than stylistic -- the second play logs in as that user, so its authorized_keys entry and its NOPASSWD sudoers entry both have to exist before it starts. That is why the key tasks live in the 'user' role and 'wheel' runs in the first play: move either into play 2 and it fails with an auth error or "Missing sudo password". Both accounts and both keys are variables. The inventory sits beside the playbook and is read via ansible.cfg, which Ansible picks up from the current working directory rather than the playbook's, so it has to be run from this directory. bootstrap.pem is gitignored -- it is the provider key for the host.
6 lines
101 B
Plaintext
6 lines
101 B
Plaintext
*.retry
|
|
.idea
|
|
|
|
# Provider bootstrap private key for prepare-server. Never commit this.
|
|
bootstrap.pem
|