Feat/bootstrap ansible

ansible/inventory-bootstrap.yaml

@@ -13,6 +13,7 @@ all:
       vars:
         ceramic_network: testnet-clay
         gcp_project: tnet-prod-2024
+        ssh_key_cd_pub: "{{ lookup('gcp_secret', gcp_project, 'bootstrap-tnet-prod-id_rsa-pub') }}"
     mainnet:
       hosts:
         bootstrap-mainnet-rust-ceramic-1.3box.io:
@@ -26,6 +27,7 @@ all:
       vars:
         ceramic_network: mainnet
         gcp_project: tnet-prod-2024
+        ssh_key_cd_pub: "{{ lookup('gcp_secret', gcp_project, 'bootstrap-tnet-prod-id_rsa-pub') }}"
     devqa:
       hosts:
         bootstrap-devqa-rust-ceramic-1.3box.io:
@@ -39,6 +41,7 @@ all:
       vars:
         ceramic_network: dev-unstable
         gcp_project: dev-qa-2023
+        ssh_key_cd_pub: "{{ lookup('gcp_secret', gcp_project, 'bootstrap-devqa-id_rsa-pub') }}"
 
   vars:
     caddy_proxy_port: 8000

ansible/playbooks/bootstrap-update.yaml

@@ -0,0 +1,18 @@
+---
+- hosts: devqa
+  serial: 1
+  become: true
+  roles:
+    - rust-ceramic
+
+- hosts: tnet
+  serial: 1
+  become: true
+  roles:
+    - rust-ceramic
+
+- hosts: mainnet
+  serial: 1
+  become: true
+  roles:
+    - rust-ceramic

ansible/roles/ceramic-prep/tasks/main.yaml

@@ -63,3 +63,22 @@
         state: directory
         owner: ceramic
   when: rust_ceramic_data_block_path is defined
+
+- name: Add CD user
+  block:
+    - name: Add Ansible user
+      ansible.builtin.user:
+        name: ansible
+        state: present
+        shell: /bin/bash
+        home: /home/ansible
+    - name: Add Ansible user to sudoers
+      ansible.builtin.lineinfile:
+        path: /etc/sudoers
+        line: "ansible ALL=(ALL) NOPASSWD:ALL"
+        state: present
+    - name: Update user's authorized_keys
+      ansible.builtin.authorized_key:
+        user: ansible
+        key: "{{ ssh_key_cd_pub }}"
+  when: ssh_key_cd_pub is defined