Prepare Clock host identity before attended key delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

ansible/roles/railiance_clock/defaults/main.yaml

@@ -16,3 +16,6 @@ railiance_clock_admission_ref: ""
 railiance_clock_max_error_ns: 500000000
 railiance_clock_measurement_margin_ns: 10000000
 railiance_clock_host_drift_ppm: 1000
+
+railiance_clock_prepare_only: false
+railiance_clock_key_preinstalled: false

ansible/roles/railiance_clock/tasks/authority.yaml

@@ -4,28 +4,10 @@
     that:
       - railiance_clock_wheelhouse | length > 0
       - railiance_clock_wheel_sha256 is match('^[0-9a-f]{64}$')
-      - railiance_clock_private_key_source | length > 0
+      - railiance_clock_key_preinstalled | bool or railiance_clock_private_key_source | length > 0
       - railiance_clock_kid | length > 0
-- name: Create unprivileged authority account
+- name: Prepare authority host identity
-  ansible.builtin.user:
+  ansible.builtin.include_tasks: prepare.yaml
-    name: railiance-clock
-    system: true
-    shell: /usr/sbin/nologin
-    create_home: false
-- name: Create root-owned install tree
-  ansible.builtin.file:
-    path: "{{ railiance_clock_install_root }}"
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
-- name: Create private signing-key directory
-  ansible.builtin.file:
-    path: "{{ railiance_clock_state_root }}"
-    state: directory
-    owner: railiance-clock
-    group: railiance-clock
-    mode: '0700'
 - name: Create public health runtime directory
   ansible.builtin.file:
     path: "{{ railiance_clock_health_root }}"
@@ -67,6 +49,7 @@
     extra_args: "--no-index --find-links={{ railiance_clock_install_root }}/wheels"
   notify: Restart admitted clock authority
 - name: Deliver admitted signing key without logging values
+  when: not railiance_clock_key_preinstalled | bool
   ansible.builtin.copy:
     src: "{{ railiance_clock_private_key_source }}"
     dest: "{{ railiance_clock_state_root }}/signing.pem"
@@ -76,6 +59,18 @@
   no_log: true
   diff: false
   notify: Restart admitted clock authority
+- name: Inspect admitted host key metadata
+  ansible.builtin.stat:
+    path: "{{ railiance_clock_state_root }}/signing.pem"
+    get_checksum: false
+  register: admitted_clock_key
+- name: Require private regular host key
+  ansible.builtin.assert:
+    that:
+      - admitted_clock_key.stat.isreg | default(false)
+      - not admitted_clock_key.stat.islnk | default(true)
+      - admitted_clock_key.stat.pw_name == 'railiance-clock'
+      - admitted_clock_key.stat.mode == '0600'
 - name: Install prebuilt read-only kernel-health probe
   ansible.builtin.copy:
     src: "{{ railiance_clock_wheelhouse }}/railiance-clock-kernel-health"

ansible/roles/railiance_clock/tasks/main.yaml

@@ -45,6 +45,9 @@
             name: systemd-timesyncd
             enabled: true
             state: started
+    - name: Prepare identity without activating authority
+      when: railiance_clock_prepare_only | bool
+      ansible.builtin.include_tasks: prepare.yaml
     - name: Install authority and health export
       when: railiance_clock_authority_enabled | bool
       ansible.builtin.include_tasks: authority.yaml

ansible/roles/railiance_clock/tasks/prepare.yaml

@@ -0,0 +1,21 @@
+---
+- name: Create unprivileged authority account
+  ansible.builtin.user:
+    name: railiance-clock
+    system: true
+    shell: /usr/sbin/nologin
+    create_home: false
+- name: Create root-owned install tree
+  ansible.builtin.file:
+    path: "{{ railiance_clock_install_root }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+- name: Create private signing-key directory
+  ansible.builtin.file:
+    path: "{{ railiance_clock_state_root }}"
+    state: directory
+    owner: railiance-clock
+    group: railiance-clock
+    mode: '0700'