added bootstrap playbook

bootstrap.yml

@@ -0,0 +1,59 @@
+---
+- name: Bootstrap CachyOS workstation
+  hosts: cachy
+  connection: local
+
+  tasks:
+    - name: Install tailscale
+      community.general.pacman:
+        name: tailscale
+        state: present
+      become: true
+
+    - name: Enable and start tailscaled
+      ansible.builtin.service:
+        name: tailscaled
+        state: started
+        enabled: true
+      become: true
+
+    - name: Clone GPG keys repo
+      ansible.builtin.git:
+        repo: cjr@192.168.0.194:/home/cjr/git/keys
+        dest: "{{ ansible_facts['user_dir'] }}/.gpg-keys"
+        update: true
+        version: main
+        accept_hostkey: true
+
+    - name: Import GPG public key
+      ansible.builtin.command:
+        cmd: gpg --import {{ ansible_facts['user_dir'] }}/.gpg-keys/public-key.asc
+      register: gpg_import_public
+      changed_when: "'imported' in gpg_import_public.stderr"
+
+    - name: Import GPG secret key
+      ansible.builtin.command:
+        cmd: gpg --import {{ ansible_facts['user_dir'] }}/.gpg-keys/secret-key.asc
+      register: gpg_import_secret
+      changed_when: "'imported' in gpg_import_secret.stderr"
+      no_log: true
+
+    - name: Remove cloned GPG keys
+      ansible.builtin.file:
+        path: "{{ ansible_facts['user_dir'] }}/.gpg-keys"
+        state: absent
+
+    - name: Clone password store
+      ansible.builtin.git:
+        repo: cjr@192.168.0.194:/home/cjr/.password-store
+        dest: "{{ ansible_facts['user_dir'] }}/.password-store"
+        update: true
+        version: main
+        accept_hostkey: true
+
+    - name: Authenticate Tailscale
+      ansible.builtin.command:
+        cmd: tailscale up --auth-key={{ lookup('pipe', 'pass show tailscale/auth-key') }}
+      become: true
+      no_log: true
+      changed_when: true