66 lines
2.2 KiB
YAML
66 lines
2.2 KiB
YAML
# ---
|
|
# sshkey.yml
|
|
#
|
|
# ssh-keyscan and copy your SSH key to hosts
|
|
#
|
|
# Parameters:
|
|
# targets: group in the inventory to use
|
|
# threads: number of simultaneous executions
|
|
# pubkey: file to hand off
|
|
# sshport (optional): override 22/tcp/ssh for Ansible control
|
|
#
|
|
# Expects ANSIBLE_VAULT_FILE to be set in the environment to path the vault
|
|
#
|
|
- hosts: "{{ targets | default('managed') }}"
|
|
order: sorted
|
|
serial: "{{ threads | default('1') }}"
|
|
gather_facts: false
|
|
ignore_unreachable: true
|
|
vars:
|
|
ansible_ssh_port: "{{ sshport | default('22') }}"
|
|
keyfile: "{{ pubkey | default(lookup('env','HOME') + '/.ssh/id_ed25519.pub') }}"
|
|
vars_files:
|
|
- "{{ lookup('env', 'ANSIBLE_VAULT_FILE') }}"
|
|
|
|
tasks:
|
|
- name: Get key
|
|
delegate_to: localhost
|
|
command: "cat {{ keyfile }}"
|
|
register: key
|
|
|
|
- name: Ensure known_hosts is commented
|
|
delegate_to: localhost
|
|
lineinfile:
|
|
dest: ~/.ssh/known_hosts
|
|
create: yes
|
|
state: present
|
|
line: "# {{ inventory_hostname + '.' + replica_domain }}"
|
|
|
|
# Thanks to https://gist.github.com/shirou/6928012
|
|
- name: Ensure ssh host RSA key known
|
|
delegate_to: localhost
|
|
lineinfile:
|
|
dest: ~/.ssh/known_hosts
|
|
create: yes
|
|
state: present
|
|
line: "{{ ip + ',' + inventory_hostname + '.' + replica_domain + ',' + lookup('pipe', 'ssh-keyscan -trsa -p' + ansible_ssh_port + ' ' + inventory_hostname) }}"
|
|
|
|
# Thanks to https://gist.github.com/shirou/6928012
|
|
- name: Ensure ssh host ED25519 key known
|
|
delegate_to: localhost
|
|
lineinfile:
|
|
dest: ~/.ssh/known_hosts
|
|
create: yes
|
|
state: present
|
|
line: "{{ ip + ',' + inventory_hostname + '.' + replica_domain + ',' + lookup('pipe', 'ssh-keyscan -ted25519 -p' + ansible_ssh_port + ' ' + inventory_hostname) }}"
|
|
|
|
- authorized_key:
|
|
user: "{{ depriv_user }}"
|
|
key: "{{ key.stdout }}"
|
|
state: present
|
|
exclusive: true
|
|
name: "Pass authorized key"
|
|
vars:
|
|
ansible_ssh_password: "{{ vars['passwords'][inventory_hostname] }}"
|
|
|