From 969f9703e96928efb0e625111cf1ab296b199d4f Mon Sep 17 00:00:00 2001
From: Chris Roberts <chris.roberts@learningunix.net>
Date: Mon, 22 Jun 2026 09:24:13 -0500
Subject: [PATCH] added ssh roles and pass repo cloning

---
 roles/packages/vars/main.yml  |  3 +++
 roles/pass/meta/main.yml      |  6 +++++
 roles/pass/tasks/main.yml     |  7 ++++++
 roles/ssh/meta/main.yml       |  6 +++++
 roles/ssh/tasks/main.yml      | 45 +++++++++++++++++++++++++++++++++++
 roles/ssh/templates/config.j2 |  9 +++++++
 site.yml                      |  4 ++++
 7 files changed, 80 insertions(+)
 create mode 100644 roles/pass/meta/main.yml
 create mode 100644 roles/pass/tasks/main.yml
 create mode 100644 roles/ssh/meta/main.yml
 create mode 100644 roles/ssh/tasks/main.yml
 create mode 100644 roles/ssh/templates/config.j2

diff --git a/roles/packages/vars/main.yml b/roles/packages/vars/main.yml
index 0d7ab1b..fc03600 100644
--- a/roles/packages/vars/main.yml
+++ b/roles/packages/vars/main.yml
@@ -1,6 +1,9 @@
 ---
 packages_to_install:
   - ansible
+  - git
+  - gnupg
+  - pass
   - ansible-lint
   - azure-cli
   - ex-vi-compat
diff --git a/roles/pass/meta/main.yml b/roles/pass/meta/main.yml
new file mode 100644
index 0000000..c684a7c
--- /dev/null
+++ b/roles/pass/meta/main.yml
@@ -0,0 +1,6 @@
+---
+galaxy_info:
+  author: cjr
+  description: Clone the pass password store
+  license: BSD-3-Clause
+  min_ansible_version: "2.1"
diff --git a/roles/pass/tasks/main.yml b/roles/pass/tasks/main.yml
new file mode 100644
index 0000000..97f3ce4
--- /dev/null
+++ b/roles/pass/tasks/main.yml
@@ -0,0 +1,7 @@
+---
+- name: Clone password store
+  ansible.builtin.git:
+    repo: cjr@git:/home/cjr/.password-store
+    dest: "{{ ansible_facts['user_dir'] }}/.password-store"
+    update: true
+    version: main
diff --git a/roles/ssh/meta/main.yml b/roles/ssh/meta/main.yml
new file mode 100644
index 0000000..e15a8c3
--- /dev/null
+++ b/roles/ssh/meta/main.yml
@@ -0,0 +1,6 @@
+---
+galaxy_info:
+  author: cjr
+  description: Deploy SSH keys and config from pass
+  license: BSD-3-Clause
+  min_ansible_version: "2.1"
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
new file mode 100644
index 0000000..d386b64
--- /dev/null
+++ b/roles/ssh/tasks/main.yml
@@ -0,0 +1,45 @@
+---
+- name: Verify gpg-agent is running
+  ansible.builtin.command:
+    cmd: gpg-agent --version
+  changed_when: false
+  register: ssh_gpg_agent_check
+  failed_when: ssh_gpg_agent_check.rc != 0
+
+- name: Ensure .ssh directory exists
+  ansible.builtin.file:
+    path: "{{ ansible_facts['user_dir'] }}/.ssh"
+    state: directory
+    mode: "0700"
+
+- name: Write ansible SSH private key
+  ansible.builtin.copy:
+    content: "{{ lookup('pipe', 'pass show ssh/id_ed25519_ansible') }}\n"
+    dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible"
+    mode: "0600"
+  no_log: true
+
+- name: Derive and write ansible SSH public key
+  ansible.builtin.shell:
+    cmd: ssh-keygen -y -f {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible > {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible.pub
+  changed_when: false
+
+- name: Deploy SSH config
+  ansible.builtin.template:
+    src: config.j2
+    dest: "{{ ansible_facts['user_dir'] }}/.ssh/config"
+    mode: "0600"
+
+- name: Fetch Gitea host key
+  ansible.builtin.command:
+    cmd: ssh-keyscan -4 -p 2222 gitea.learningunix.net
+  register: ssh_gitea_host_key
+  changed_when: false
+
+- name: Add Gitea host key to known_hosts
+  ansible.builtin.known_hosts:
+    name: "[gitea.learningunix.net]:2222"
+    key: "{{ item }}"
+    path: "{{ ansible_facts['user_dir'] }}/.ssh/known_hosts"
+    state: present
+  loop: "{{ ssh_gitea_host_key.stdout_lines }}"
diff --git a/roles/ssh/templates/config.j2 b/roles/ssh/templates/config.j2
new file mode 100644
index 0000000..ba6f7b3
--- /dev/null
+++ b/roles/ssh/templates/config.j2
@@ -0,0 +1,9 @@
+Host gitea.learningunix.net
+    User git
+    Port 2222
+    IdentityFile ~/.ssh/id_ed25519_ansible
+
+Host learningunix
+    HostName 91.99.74.227
+    User cjr
+    IdentityFile ~/.ssh/id_ed25519
diff --git a/site.yml b/site.yml
index 2533c06..9956c11 100644
--- a/site.yml
+++ b/site.yml
@@ -23,6 +23,10 @@
   connection: local
 
   roles:
+    - role: ssh
+      tags: ssh
+    - role: pass
+      tags: pass
     - role: dotfiles
       tags: dotfiles
     - role: scripts