75 lines
2.5 KiB
YAML
75 lines
2.5 KiB
YAML
---
|
|
# Per-server SSH key for cloning from Gitea.
|
|
# 1. Generate an ed25519 key for the deploy user (if absent).
|
|
# 2. Configure SSH for the Gitea host (port + identity).
|
|
# 3. Test access first; only surface the "add this key" step when it's missing.
|
|
|
|
- name: gitea-key | ensure .ssh dir
|
|
ansible.builtin.file:
|
|
path: "/home/{{ admin_user }}/.ssh"
|
|
state: directory
|
|
owner: "{{ admin_user }}"
|
|
group: "{{ admin_user }}"
|
|
mode: "0700"
|
|
|
|
- name: gitea-key | generate deploy key
|
|
become_user: "{{ admin_user }}"
|
|
ansible.builtin.command:
|
|
cmd: "ssh-keygen -t ed25519 -N '' -f {{ gitea_key_path }} -C '{{ admin_user }}@{{ inventory_hostname }}-gitea'"
|
|
creates: "{{ gitea_key_path }}"
|
|
|
|
- name: gitea-key | configure SSH for Gitea host
|
|
become_user: "{{ admin_user }}"
|
|
ansible.builtin.blockinfile:
|
|
path: "/home/{{ admin_user }}/.ssh/config"
|
|
create: true
|
|
owner: "{{ admin_user }}"
|
|
group: "{{ admin_user }}"
|
|
mode: "0600"
|
|
marker: "# {mark} ANSIBLE MANAGED gitea"
|
|
block: |
|
|
Host {{ gitea_ssh_host }}
|
|
User git
|
|
Port {{ gitea_ssh_port }}
|
|
IdentityFile {{ gitea_key_path }}
|
|
IdentitiesOnly yes
|
|
StrictHostKeyChecking accept-new
|
|
|
|
- name: gitea-key | read public key
|
|
ansible.builtin.slurp:
|
|
src: "{{ gitea_key_path }}.pub"
|
|
register: _gitea_pubkey
|
|
|
|
- name: gitea-key | check Gitea access (permission probe)
|
|
become_user: "{{ admin_user }}"
|
|
ansible.builtin.command:
|
|
cmd: "git ls-remote {{ git_base_url }}/{{ gitea_test_repo }}"
|
|
register: _gitea_access
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: gitea-key | access OK
|
|
ansible.builtin.debug:
|
|
msg: "{{ inventory_hostname }} already has Gitea access; nothing to add."
|
|
when: _gitea_access.rc == 0
|
|
|
|
- name: gitea-key | ADD THIS KEY to Gitea (access missing)
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
================= ACTION REQUIRED on {{ inventory_hostname }} =================
|
|
This server cannot reach Gitea yet. Add its public key:
|
|
|
|
{{ _gitea_pubkey.content | b64decode | trim }}
|
|
|
|
Where (either works):
|
|
* User key : Gitea > Settings > SSH / GPG Keys > Add Key
|
|
* Deploy key: repo > Settings > Deploy Keys (per repo, read-only)
|
|
Then re-run provisioning to continue.
|
|
==============================================================================
|
|
when: _gitea_access.rc != 0
|
|
|
|
- name: gitea-key | fail until key is added
|
|
ansible.builtin.fail:
|
|
msg: "No Gitea access from {{ inventory_hostname }}. Add the key shown above, then re-run."
|
|
when: _gitea_access.rc != 0
|