feat(gnupg): add role for configuring gnupg with support to act as an ssh agent

roles/gnupg/templates/gpg-agent.conf.j2

@@ -0,0 +1,13 @@
+default-cache-ttl {{ gpg_agent_config_cache_ttl }}
+default-cache-ttl-ssh {{ gpg_agent_config_cache_ttl_ssh }}
+max-cache-ttl {{ gpg_agent_config_cache_ttl }}
+max-cache-ttl-ssh {{ gpg_agent_config_cache_ttl_ssh }}
+{% if not gpg_agent_config_allow_external_cache %}
+no-allow-external-cache
+{% endif %}
+{% if gpg_agent_config_enable_ssh_support %}
+enable-ssh-support
+{% endif %}
+{% if gpg_agent_config_ignore_cache_for_signing %}
+ignore-cache-for-signing
+{% endif %}

roles/gnupg/templates/gpg.conf.j2

@@ -0,0 +1,29 @@
+{% if not gpg_config_emit_version %}
+no-emit-version
+{% endif %}
+{% if not gpg_config_comments %}
+no-comments
+{% endif %}
+cert-digest-algo {{ gpg_config_cert_digest_algo }}
+personal-cipher-preferences AES AES256 AES192 CAST5
+personal-digest-preferences SHA256 SHA512 SHA384 SHA224
+{% if gpg_config_ignore_time_conflict %}
+ignore-time-conflict
+{% endif %}
+
+# How to render keys
+keyid-format {{ gpg_config_keyid_format }}
+{% if gpg_config_with_fingerprint %}
+with-fingerprint
+{% endif %}
+{% if gpg_config_allow_freeform_uid %}
+allow-freeform-uid
+{% endif %}
+
+# Keyserver settings
+{% if gpg_config_keyserver %}
+keyserver {{ gpg_config_keyserver }}
+{% endif %}
+{% if gpg_config_keyserver_options %}
+keyserver-options {{ gpg_config_keyserver_options | join(' ') }}
+{% endif%}

roles/gnupg/templates/sshcontrol.j2

@@ -0,0 +1,14 @@
+# List of allowed ssh keys.  Only keys present in this file are used
+# in the SSH protocol.  The ssh-add tool may add new entries to this
+# file to enable them; you may also add them manually.  Comment
+# lines, like this one, as well as empty lines are ignored.  Lines do
+# have a certain length limit but this is not serious limitation as
+# the format of the entries is fixed and checked by gpg-agent. A
+# non-comment line starts with optional white spaces, followed by the
+# keygrip of the key given as 40 hex digits, optionally followed by a
+# caching TTL in seconds, and another optional field for arbitrary
+# flags.   Prepend the keygrip with an '!' mark to disable it.
+
+{% for keygrip in gpg_keygrips_for_ssh %}
+{{ keygrip }}
+{% endfor %}