---
# Deploy OpenBao SSH user CA trust and per-user auth_principals.
#
# Prerequisite: railiance-platform openbao-configure-ssh (exports CA pubkey).
#
#   cd ~/railiance-platform
#   OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token \
#     OPENBAO_SSH_CA_PUBKEY_OUT=/tmp/openbao-ssh-ca.pub \
#     make openbao-configure-ssh
#
#   cd ~/railiance-infra
#   make bootstrap-ssh-ca SSH_CA_PUBKEY=/tmp/openbao-ssh-ca.pub
#
# Restricted agent accounts only (RAIL-HO-WP-0014; no CA key needed):
#   cd ansible && ansible-playbook playbooks/bootstrap-ssh-ca.yaml \
#     --limit Railiance01 --tags restricted_agent_account --check --diff

- name: Deploy SSH CA trust, auth_principals and restricted agent accounts
  hosts: all
  become: true
  vars_files:
    - ../inventory/ssh_principals.yaml
  roles:
    - role: ssh_ca_host