transcaffeine
6f8ee3627d
Loads the gnupg_agent-skript in the ~/.bashrc, which exports the needed variables (SSH_AUTH_SOCK, SSH_AGENT_PID, GPG_AGENT_INFO). Also downloads the pubkey of the user and sets ownertrust on the key. Fixes #3
64 lines
1.5 KiB
YAML
64 lines
1.5 KiB
YAML
---
|
|
# Installs GnuPG2 and templates the configs
|
|
|
|
- name: Install gnupg (RedHat*)
|
|
package:
|
|
name: gnupg2
|
|
state: latest
|
|
become: yes
|
|
become_user: root
|
|
become_method: sudo
|
|
when: ansible_os_family == "RedHat"
|
|
ignore_errors: true
|
|
|
|
- name: Install gnupg (Arch)
|
|
package:
|
|
name: gnupg
|
|
state: latest
|
|
when: ansible_os_family == "Archlinux"
|
|
|
|
- name: Configure gpg.conf (behaviour of gpg)
|
|
template:
|
|
src: gpg.conf.j2
|
|
dest: "{{ gpg_folder }}/gpg.conf"
|
|
|
|
- name: Configure gpg-agent.conf (agent configuration)
|
|
template:
|
|
src: gpg-agent.conf.j2
|
|
dest: "{{ gpg_folder }}/gpg-agent.conf"
|
|
|
|
- name: Configure ssh-control (in order for gpg-agent to act as ssh-agent)
|
|
template:
|
|
src: sshcontrol.j2
|
|
dest: "{{ gpg_folder }}/sshcontrol"
|
|
|
|
- name: Copy gnupg_agent script, which makes gpg-agent responsible for ssh-auth
|
|
template:
|
|
src: gnupg_agent.j2
|
|
dest: "{{ gpg_folder }}/gnupg_agent"
|
|
mode: 0700
|
|
|
|
- name: Ensure gnupg_agent skript is included in .bashrc so SSH uses gpg-agent
|
|
blockinfile:
|
|
path: "~/.bashrc"
|
|
insertafter: "\[\[ \$- != \*i\* \]\] && return"
|
|
line: |
|
|
# load script telling SSH to use the gpg agent
|
|
source "{{ gpg_folder }}"/gnupg_agent
|
|
state: present
|
|
|
|
- name: Download own pubkey
|
|
get_url:
|
|
url: "https://git.finallycoffee.eu/{{ gpg_user }}/about/raw/branch/master/pubkey.asc"
|
|
dest: "~/{{ gpg_user }}.pub"
|
|
|
|
- name: Import own pubkey and set owner-trust
|
|
command:
|
|
cmd: |
|
|
gpg2 --no-tty --command-fd 0 --import ~/{{ gpg_user }}.pub << EOF
|
|
trust
|
|
5
|
|
quit
|
|
EOF
|
|
|