init

.bootstrap/ansible-ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAFMM1IPHOss23GMLG4SSpyXxgflbYxXzQmXsyCbQ77U ansible-control

.bootstrap/readme.md

@@ -0,0 +1,5 @@
+# setup-ansible-service-account.sh
+
+## Usage
+
+`sudo setup-ansible-service-account.sh ./ansible-ed25519.pub`

.bootstrap/setup-ansible-service-account.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ANSIBLE_USER="ansible"
+ANSIBLE_HOME="/home/${ANSIBLE_USER}"
+SSH_DIR="${ANSIBLE_HOME}/.ssh"
+AUTHORIZED_KEYS="${SSH_DIR}/authorized_keys"
+SUDOERS_FILE="/etc/sudoers.d/${ANSIBLE_USER}"
+
+if [[ $# -ne 1 ]]; then
+    echo "Usage: $0 /path/to/ansible-control-node.pub" >&2
+    exit 1
+fi
+
+KEY_FILE="$1"
+
+if [[ ! -f "$KEY_FILE" ]]; then
+    echo "[ERROR] Public key file not found: $KEY_FILE" >&2
+    exit 1
+fi
+
+PUBLIC_KEY="$(< "$KEY_FILE")"
+
+if ! grep -Eq '^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) [A-Za-z0-9+/=]+([[:space:]].*)?$' <<< "$PUBLIC_KEY"; then
+    echo "[ERROR] Invalid OpenSSH public key format" >&2
+    exit 1
+fi
+
+if [[ "$(id -u)" -ne 0 ]]; then
+    SUDO="sudo"
+else
+    SUDO=""
+fi
+
+$SUDO true
+
+if ! id "$ANSIBLE_USER" >/dev/null 2>&1; then
+    $SUDO useradd --create-home --shell /bin/bash "$ANSIBLE_USER"
+fi
+
+$SUDO passwd -l "$ANSIBLE_USER" >/dev/null
+
+$SUDO install -d -o "$ANSIBLE_USER" -g "$ANSIBLE_USER" -m 700 "$SSH_DIR"
+$SUDO touch "$AUTHORIZED_KEYS"
+$SUDO chown "$ANSIBLE_USER:$ANSIBLE_USER" "$AUTHORIZED_KEYS"
+$SUDO chmod 600 "$AUTHORIZED_KEYS"
+
+if ! $SUDO grep -Fxq "$PUBLIC_KEY" "$AUTHORIZED_KEYS"; then
+    echo "$PUBLIC_KEY" | $SUDO tee -a "$AUTHORIZED_KEYS" >/dev/null
+fi
+
+TMP_AUTH_KEYS="$(mktemp)"
+$SUDO awk 'NF && !seen[$0]++' "$AUTHORIZED_KEYS" > "$TMP_AUTH_KEYS"
+$SUDO install -o "$ANSIBLE_USER" -g "$ANSIBLE_USER" -m 600 "$TMP_AUTH_KEYS" "$AUTHORIZED_KEYS"
+rm -f "$TMP_AUTH_KEYS"
+
+TMP_SUDOERS="$(mktemp)"
+cat > "$TMP_SUDOERS" <<EOF
+${ANSIBLE_USER} ALL=(ALL) NOPASSWD: ALL
+EOF
+
+$SUDO visudo -cf "$TMP_SUDOERS" >/dev/null
+$SUDO install -o root -g root -m 0440 "$TMP_SUDOERS" "$SUDOERS_FILE"
+rm -f "$TMP_SUDOERS"
+
+$SUDO visudo -cf "$SUDOERS_FILE" >/dev/null
+
+echo "[OK] Ansible service account configured successfully"