48 lines
1.4 KiB
YAML
Executable File
48 lines
1.4 KiB
YAML
Executable File
---
|
|
- name: gen_bootstrap
|
|
hosts: localhost
|
|
gather_facts: false
|
|
vars_files: main.yml
|
|
tasks:
|
|
- name: Assert extra-vars are set
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item | length > 0
|
|
msg: "{{ item }} environment variable must be set"
|
|
with_items:
|
|
- KEY
|
|
- DOC_KEY
|
|
- DUPLICITY_PASSPHRASE
|
|
|
|
- name: Assert SECRETS_ARCHIVE_PASSPHRASE environment variable is set
|
|
ansible.builtin.assert:
|
|
that:
|
|
- lookup('env','SECRETS_ARCHIVE_PASSPHRASE') | length > 0
|
|
msg: "SECRETS_ARCHIVE_PASSPHRASE environment variable must be set"
|
|
|
|
- name: Download secrets.tar.gz.enc
|
|
ansible.builtin.get_url:
|
|
url: "https://{{ CLOUD_SERVER }}/s/{{ KEY }}/download?path=%2F&files=secrets.tar.gz.enc"
|
|
dest: /root/secrets.tar.gz.enc
|
|
|
|
- name: Install openssh-client
|
|
ansible.builtin.package:
|
|
name: openssh-client
|
|
state: present
|
|
|
|
- name: Create /root/.ssh directory
|
|
ansible.builtin.file:
|
|
path: /root/.ssh
|
|
state: directory
|
|
mode: '0700'
|
|
|
|
- name: Extract from secrets.tar.gz.enc
|
|
shell: "openssl enc -aes-256-cbc -md md5 -pass env:SECRETS_ARCHIVE_PASSPHRASE -d -in /root/secrets.tar.gz.enc | tar -zxv -C /root/"
|
|
|
|
- name: Change SSH private key permissions
|
|
ansible.builtin.file:
|
|
path: /root/.ssh/id_rsa
|
|
mode: '0400'
|
|
|
|
|