setup-password-manager.yml

- name: Get information about ansible control machine
  hosts: localhost
  gather_facts: yes

- hosts: all
  gather_facts: no
  tasks:
    - name: ensure that localhost is not skipped
      assert:
        that:
          - '"ansible_hostname" in hostvars.localhost'
        msg:
          - Hostvars from localhost are required to run some tasks.
          - Make sure to include localhost when using --limit.


- name: Setup password store
  hosts: all

  vars:
    control_machine_name: "{{ hostvars.localhost.ansible_hostname }}"
    control_machine_address: "{{ control_machine_name }}.local"
    # Use ~ instead of ansible_env.HOME because it must expand differently
    # on src and dest host in sync tasks
    gpg_exchange_dir: "~/.gnupg/import-export/"
    gpg_rsynced_dirs:
      - ~/.gnupg/private-keys-v1.d/
      - ~/.gnupg/openpgp-revocs.d/

  roles:
    - known-hosts

  tags: sync
  tasks:

    - name: install apt packages
      apt:
        name:
          - expect  # for automatic ssh key unlocking
          - gnupg2  # I want to be able to use gpg2 command for compatibility
          - git
          - xclip  # for putting password in clipboard
          - pass
          - pinentry-tty  # for unlocking keys in agent without gui
          - pwgen  # password generator
          - oathtool  # for generating one-time passwords
      become: yes

    - name: ensure directories exist
      file:
        dest: "{{ item }}"
        state: directory
        mode: 0700
      loop:
        - ~/.ssh/
        - ~/.ssh/keys/
        - ~/.gnupg/
        - "{{ gpg_exchange_dir }}"
        - ~/.gnupg/openpgp-revocs.d/
        - ~/.gnupg/private-keys-v1.d/

    - name: Two-way sync - pull data from nodes
      tags: never  # Run only when explicitly called with --tags sync.
      block:

        - name: pull private keys and revocation certs
          synchronize:
            # Trailing slash is important!
            src: "{{ item }}/"
            dest: "{{ item }}/"
            mode: pull
          loop: "{{ gpg_rsynced_dirs }}"

        - name: export pubring and ownertrust
          shell: |
            gpg2 --export --armor > {{ gpg_exchange_dir }}/{{ inventory_hostname }}_pubring.asc &&
            gpg2 --export-ownertrust > {{ gpg_exchange_dir }}/{{ inventory_hostname }}_ownertrust

        - name: pull pubrings and ownertrusts
          fetch:
            src: "{{ item }}"
            # Trailing slash is important!
            dest: "{{ gpg_exchange_dir }}/"
            flat: yes
          loop:
            - "{{ gpg_exchange_dir }}/{{ inventory_hostname }}_pubring.asc"
            - "{{ gpg_exchange_dir }}/{{ inventory_hostname }}_ownertrust"

        - delegate_to: localhost
          run_once: yes
          block:

            - name: import pubrings to control machine
              shell: gpg2 --import {{ gpg_exchange_dir }}/*_pubring.asc

            - name: import ownertrusts to control machine
              shell: gpg2 --import-ownertrust {{ item }}
              with_fileglob: "{{ gpg_exchange_dir }}/*_ownertrust"

    - name: sync private keys and revocation certs
      synchronize:
        # trailing slash is important
        src: "{{ item }}/"
        dest: "{{ item }}/"
        mode: push
      loop: "{{ gpg_rsynced_dirs }}"

    - name: export control machine pubring and ownertrust
      shell: |
        gpg2 --export --armor > {{ gpg_exchange_dir }}/{{ control_machine_name }}_pubring.asc &&
        gpg2 --export-ownertrust > {{ gpg_exchange_dir }}/{{ control_machine_name }}_ownertrust
      delegate_to: localhost
      run_once: yes

    - name: sync pubring and ownertrust
      synchronize:
        src: "{{ item }}"
        dest: "{{ item }}"
        mode: push
      loop:
        - "{{ gpg_exchange_dir }}/{{ control_machine_name }}_pubring.asc"
        - "{{ gpg_exchange_dir }}/{{ control_machine_name }}_ownertrust"

    - name: import pubring and ownertrust
      shell: |
        gpg2 --import {{ gpg_exchange_dir }}/{{ control_machine_name }}_pubring.asc &&
        gpg2 --import-ownertrust {{ gpg_exchange_dir }}/{{ control_machine_name }}_ownertrust

    - name: clone password store
      git:
        repo: git@bitbucket.org:jan-warchol/password-store.git
        dest: "{{ passwordstore_path }}"
        update: no  # "yes" can reset --hard unpushed commits
        recursive: no  # "offline" module requires special steps

    - name: setup symbolic link
      file:
        src: "{{ passwordstore_path }}"
        dest: "{{ ansible_env.HOME }}/.password-store"
        state: link
        force: no

    - name: configure git user email
      git_config:
        key: user.email
        value: jan.warchol@gmail.com
        repo: "{{ passwordstore_path }}"

    - name: clone special submodule with top-secret passwords
      git:
        accept_hostkey: yes  # low risk since it's over LAN
        # FIXME: passwordstore_path should be taken from control machine hostvars
        repo: jan@{{ control_machine_address }}:{{ passwordstore_path }}/offline
        dest: "{{ passwordstore_path }}/offline"
      # doesn't make sense to clone repo into itself
      when: inventory_hostname != control_machine_name

    - name: configure git user email
      git_config:
        key: user.email
        value: jan.warchol@gmail.com
        repo: "{{ passwordstore_path }}/offline"