ansible-keys.yml

# keys setup playbook
#
#   ansible-keys.yml
---
- name: keys setup
  hosts: all
  tasks:
    - name: check mandatory variables are defined
      assert:
        that:
          - user is defined

    # .gnupg
    - name: get new gpg dir stats
      stat:
        path: "/home/{{ user }}/data/keys/dot-gnupg"
      register: new_gnupg
    - name: setup gpg dir
      block:
        - name: ensure correct permissions for .gnupg dir
          file:
            path: "/home/{{ user }}/data/keys/dot-gnupg"
            mode: 0700
        - name: symlink new gpg dir
          file:
            src: "/home/{{ user }}/data/keys/dot-gnupg"
            dest: "/home/{{ user }}/.gnupg"
            state: link
            force: true
          become_user: "{{ user }}"
      when: new_gnupg.stat.exists == true

    # setup pass
    - name: install pass
      dnf:
        name: pass
        state: present
    - name: get new pass dir stats
      stat:
        path: "/home/{{ user }}/data/keys/dot-password-store"
      register: new_password_store
    - name: setup pass dir
      file:
        src: "/home/{{ user }}/data/keys/dot-password-store"
        dest: "/home/{{ user }}/.password-store"
        state: link
        force: true
      become_user: "{{ user }}"
      when: new_password_store.stat.exists == true

    # .ssh
    - name: get new ssh dir stats
      stat:
        path: "/home/{{ user }}/data/keys/dot-ssh"
      register: new_ssh
    - name: setup ssh dir
      block:
        - name: ensure correct permissions for .ssh dir
          file:
            path: "/home/{{ user }}/data/keys/dot-ssh"
            mode: 0700
        - name: get default private ssh key stats
          stat:
            path: "/home/{{ user }}/data/keys/dot-ssh/id_rsa"
          register: default_ssh_key
        - name: ensure correct permissions for default priva ssh key
          file:
            path: "/home/{{ user }}/data/keys/dot-ssh/id_rsa"
            mode: 0600
          when: default_ssh_key.stat.exists == true
        # check ssh dir is symlink and remove if not
        # otherwise SELinux prevents creating symlink
        # as it is a non-empty directory
        - name: get old ssh dir stats
          stat:
            path: "/home/{{ user }}/.ssh"
          register: old_ssh
        - name: remove old ssh dir if not symlink
          file:
            state: absent
            path: "/home/{{ user }}/.ssh"
          when: >
            old_ssh.stat.exists == true and
            ( old_ssh.stat.islnk is not defined or old_ssh.stat.islnk == false )
        - name: symlink new ssh dir
          file:
            src: "/home/{{ user }}/data/keys/dot-ssh"
            dest: "/home/{{ user }}/.ssh"
            state: link
          become_user: "{{ user }}"
        - name: set auto-install-key permissions
          file:
            path: "/home/{{ user }}/.ssh/auto-install-key"
            mode: "0600"
      when: new_ssh.stat.exists == true
    - name: add ssh key to keyring
      shell: eval $(ssh-agent)
      become_user: "{{ user }}"
      changed_when: false

    # .pgpass
    - name: get new postgresql password file stats
      stat:
        path: "/home/{{ user }}/data/keys/dot-pgpass"
      register: new_pgpass
    - name: setup postgresql password file
      block:
        - name: ensure correct permissions for postgresql password file
          file:
            path: "/home/{{ user }}/data/keys/dot-pgpass"
            mode: 0600
        - name: symlink postgresql password file
          file:
            src: "/home/{{ user }}/data/keys/dot-pgpass"
            dest: "/home/{{ user }}/.pgpass"
            state: link
            force: true
          become_user: "{{ user }}"
      when: new_pgpass.stat.exists == true