added ssh roles and pass repo cloning

roles/packages/vars/main.yml

@@ -1,6 +1,9 @@
 ---
 packages_to_install:
   - ansible
+  - git
+  - gnupg
+  - pass
   - ansible-lint
   - azure-cli
   - ex-vi-compat

roles/pass/meta/main.yml

@@ -0,0 +1,6 @@
+---
+galaxy_info:
+  author: cjr
+  description: Clone the pass password store
+  license: BSD-3-Clause
+  min_ansible_version: "2.1"

roles/pass/tasks/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Clone password store
+  ansible.builtin.git:
+    repo: cjr@git:/home/cjr/.password-store
+    dest: "{{ ansible_facts['user_dir'] }}/.password-store"
+    update: true
+    version: main

roles/ssh/meta/main.yml

@@ -0,0 +1,6 @@
+---
+galaxy_info:
+  author: cjr
+  description: Deploy SSH keys and config from pass
+  license: BSD-3-Clause
+  min_ansible_version: "2.1"

roles/ssh/tasks/main.yml

@@ -0,0 +1,45 @@
+---
+- name: Verify gpg-agent is running
+  ansible.builtin.command:
+    cmd: gpg-agent --version
+  changed_when: false
+  register: ssh_gpg_agent_check
+  failed_when: ssh_gpg_agent_check.rc != 0
+
+- name: Ensure .ssh directory exists
+  ansible.builtin.file:
+    path: "{{ ansible_facts['user_dir'] }}/.ssh"
+    state: directory
+    mode: "0700"
+
+- name: Write ansible SSH private key
+  ansible.builtin.copy:
+    content: "{{ lookup('pipe', 'pass show ssh/id_ed25519_ansible') }}\n"
+    dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible"
+    mode: "0600"
+  no_log: true
+
+- name: Derive and write ansible SSH public key
+  ansible.builtin.shell:
+    cmd: ssh-keygen -y -f {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible > {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible.pub
+  changed_when: false
+
+- name: Deploy SSH config
+  ansible.builtin.template:
+    src: config.j2
+    dest: "{{ ansible_facts['user_dir'] }}/.ssh/config"
+    mode: "0600"
+
+- name: Fetch Gitea host key
+  ansible.builtin.command:
+    cmd: ssh-keyscan -4 -p 2222 gitea.learningunix.net
+  register: ssh_gitea_host_key
+  changed_when: false
+
+- name: Add Gitea host key to known_hosts
+  ansible.builtin.known_hosts:
+    name: "[gitea.learningunix.net]:2222"
+    key: "{{ item }}"
+    path: "{{ ansible_facts['user_dir'] }}/.ssh/known_hosts"
+    state: present
+  loop: "{{ ssh_gitea_host_key.stdout_lines }}"

roles/ssh/templates/config.j2

@@ -0,0 +1,9 @@
+Host gitea.learningunix.net
+    User git
+    Port 2222
+    IdentityFile ~/.ssh/id_ed25519_ansible
+
+Host learningunix
+    HostName 91.99.74.227
+    User cjr
+    IdentityFile ~/.ssh/id_ed25519

site.yml

@@ -23,6 +23,10 @@
   connection: local
 
   roles:
+    - role: ssh
+      tags: ssh
+    - role: pass
+      tags: pass
     - role: dotfiles
       tags: dotfiles
     - role: scripts