roles/git: ssh known_hosts is now idempotent

- roles/git now uses blockinfile to ensure the github ssh keypairs are trusted, and to allow subsequent ssh keypairs to be trusted and not overwritten by future runs.
- this commit marks idempotency for all roles. after a successful run of this playbook, subsequent runs will result in a change=0 !!!!!

.github/workflows/deploy.yaml

@@ -1,27 +0,0 @@
-# name: Run Playbook
-
-# on:
-#   push:
-#     tags:
-#       - "v*.*.*"
-
-# jobs:
-#   deploy:
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Set up Git repository
-#         uses: actions/checkout@v3
-#         with:
-#           ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}
-#           submodules: recursive
-#       - name: Run Ansible-Playbook
-#         uses: dawidd6/action-ansible-playbook@v2
-#         with:
-#           playbook: run.yml
-#           key: ${{ secrets.SSH_PRIVATE_KEY }}
-#           inventory: |
-#             [hosts]
-#             openpunk-vps ansible_host=96.30.199.68 ansible_user=root ansible_connection=ssh
-#           vault_password: ${{ secrets.VAULT_PASSWORD }}
-#           options: |
-#             --extra-vars domain=openpunk.com

roles/essential/tasks/main.yml

@@ -1,17 +1,4 @@
 ---
-# TODO: make idempotent
-- name: Add Gitea repo key
-  shell: curl -s https://packaging.gitlab.io/gitea/gpg.key | sudo gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/morph027-gitea.gpg --import
-
-# TODO: make idempotent
-- name: Set key perms
-  shell: sudo chmod 644 /etc/apt/trusted.gpg.d/morph027-gitea.gpg
-
-- name: Add Gitea repo
-  apt_repository:
-    filename: morph027-gitea
-    repo: deb https://packaging.gitlab.io/gitea gitea main
-
 - name: Upgrade Packages
   apt:
     update_cache: yes
@@ -21,7 +8,6 @@
   package:
     name:
       - hugo
-      - gitea
       - git
       - nginx
       - tor
@@ -32,9 +18,10 @@
       - zsh # :D
       - python3-certbot-nginx
 
-# TODO: make idempotent
+- name: Setup zsh
-- name: Setup default shell (zsh)
+  user:
-  shell: chsh -s /usr/bin/zsh
+    name: "{{ ansible_user }}"
+    shell: /usr/bin/zsh
 
 - name: Clone Powerlevel10k theme
   git:

roles/git/tasks/main.yml

@@ -9,21 +9,22 @@
 # make sure our vps trusts the github.com key signature. we pipe the output
 # of ssh-keyscan into .ssh/known_hosts
 
-# TODO: make idempotent
 - name: Scan for SSH host keys
   command: ssh-keyscan github.com 2>/dev/null
   register: ssh_scan
+  changed_when: false
 
-- name: Update known_hosts
+- name: Update .ssh/known_hosts
-  copy:
+  blockinfile:
-    content: "{{ ssh_scan.stdout_lines|join('\n')  }}"
+    path: /root/.ssh/known_hosts
-    dest: /root/.ssh/known_hosts
+    block: "{{ ssh_scan.stdout_lines|join('\n') }}"
+    insertbefore: BOF
+    create: yes
     owner: root
     mode: u=rw,g=,o=
-    force: no # if we already have a known_hosts file, ignore!
 
 # this keypair is trusted under my github account, so it allows my vps to make pushes
-# to the main branch of my openpunk repository. (for my deadswitch: see static/blog/imdead.sh)
+# to the main branch of my openpunk repository. (see roles/deadswitchfiles/imdead.sh)
 
 - name: Install ssh priv key
   copy:

roles/gitea/tasks/main.yml

@@ -1,7 +1,34 @@
 ---
+- name: Check if Gitea is installed
+  shell: gitea --version
+  register: validate_gitea
+  changed_when: no
+
+- name: Add Gitea key && repository
+  block:
+    - name: Check for Gitea gpg key
+      stat:
+        path: /etc/apt/trusted.gpg.d/morph027-gitea.gpg
+      register: gitea_key
+
+    - name: Import Gitea key
+      shell: curl -s https://packaging.gitlab.io/gitea/gpg.key | sudo gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/morph027-gitea.gpg --import && sudo chmod 644 /etc/apt/trusted.gpg.d/morph027-gitea.gpg
+      when: gitea_key.stat.exists == false or gitea_key.stat.mode != "0644"
+
+    - name: Add Gitea repository
+      apt_repository:
+        filename: morph027-gitea
+        repo: deb https://packaging.gitlab.io/gitea gitea main
+  when: '"not found" in validate_gitea.stdout'
+
+- name: Install Gitea
+  package:
+    name:
+      - gitea
+
 - name: Configure Gitea
   template:
-    src: app.ini
+    src: templates/app.ini
     dest: /etc/gitea/app.ini
     owner: gitea
     force: no # we don't want to kill our existing config D:

roles/tor/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 - name: Install torrc
   template:
-    src: torrc
+    src: templates/torrc
     dest: /etc/tor/torrc
     owner: root
     group: root