coulomb/railiance-infra
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ansible): inject ops-bridge key in base role at bootstrap

Browse source 
Add ops_bridge_pubkey to group_vars/all.yaml (public key only, safe to
commit) and inject it via ansible.posix.authorized_key in the base role,
immediately after SSH hardening. This ensures ops-bridge tunnel
connectivity is available as soon as SSH infrastructure is up on any
managed host — no manual key provisioning required for new nodes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-03-27 23:52:54 +01:00
parent ab92c58bda
commit 3f4f03e838
2 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ansible/inventory/group_vars/all.yaml
View file

@ -18,3 +18,9 @@
custodian_agent_user: tegwick
custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"
# ops-bridge tunnel key — injected by the base role so ops-bridge connectivity
# is available as early as SSH infrastructure is up.
# Private key lives at ~/.ssh/id_ops on the workstation. Never commit the private key.
ops_bridge_user: tegwick
ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AITpz6sMWdCN0MeMOzL82u ops-bridge@custodian"