From ad28d39de93ce0a47f50289577137b46c25276ca Mon Sep 17 00:00:00 2001
From: Chris Roberts <chris.roberts@learningunix.net>
Date: Mon, 22 Jun 2026 12:01:36 -0500
Subject: [PATCH] added bootstrap playbook

---
 bootstrap.yml | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 bootstrap.yml

diff --git a/bootstrap.yml b/bootstrap.yml
new file mode 100644
index 0000000..9864392
--- /dev/null
+++ b/bootstrap.yml
@@ -0,0 +1,59 @@
+---
+- name: Bootstrap CachyOS workstation
+  hosts: cachy
+  connection: local
+
+  tasks:
+    - name: Install tailscale
+      community.general.pacman:
+        name: tailscale
+        state: present
+      become: true
+
+    - name: Enable and start tailscaled
+      ansible.builtin.service:
+        name: tailscaled
+        state: started
+        enabled: true
+      become: true
+
+    - name: Clone GPG keys repo
+      ansible.builtin.git:
+        repo: cjr@192.168.0.194:/home/cjr/git/keys
+        dest: "{{ ansible_facts['user_dir'] }}/.gpg-keys"
+        update: true
+        version: main
+        accept_hostkey: true
+
+    - name: Import GPG public key
+      ansible.builtin.command:
+        cmd: gpg --import {{ ansible_facts['user_dir'] }}/.gpg-keys/public-key.asc
+      register: gpg_import_public
+      changed_when: "'imported' in gpg_import_public.stderr"
+
+    - name: Import GPG secret key
+      ansible.builtin.command:
+        cmd: gpg --import {{ ansible_facts['user_dir'] }}/.gpg-keys/secret-key.asc
+      register: gpg_import_secret
+      changed_when: "'imported' in gpg_import_secret.stderr"
+      no_log: true
+
+    - name: Remove cloned GPG keys
+      ansible.builtin.file:
+        path: "{{ ansible_facts['user_dir'] }}/.gpg-keys"
+        state: absent
+
+    - name: Clone password store
+      ansible.builtin.git:
+        repo: cjr@192.168.0.194:/home/cjr/.password-store
+        dest: "{{ ansible_facts['user_dir'] }}/.password-store"
+        update: true
+        version: main
+        accept_hostkey: true
+
+    - name: Authenticate Tailscale
+      ansible.builtin.command:
+        cmd: tailscale up --auth-key={{ lookup('pipe', 'pass show tailscale/auth-key') }}
+      become: true
+      no_log: true
+      changed_when: true