roles/gnupg/tasks/main.yml

   1 ---
   2 - name: Config files
   3   copy:
   4     src: "gnupg/{{ gnupg_config_item }}"
   5     dest: "$XDG_CONFIG_HOME/gnupg/{{ gnupg_config_item }}"
   6   loop:
   7     - gpg-agent.conf
   8     - gpg.conf
   9   loop_control:
  10     loop_var: gnupg_config_item
  11 - name: Protect directory
  12   file:
  13     path: $XDG_CONFIG_HOME/gnupg
  14     state: directory
  15     mode: 0700
  16 - name: Get gnupg runtime folder name
  17   shell: 'gpgconf --list-dirs socketdir | sed -e "s@$XDG_RUNTIME_DIR/gnupg/@@"'
  18   register: gnupg_runtime_dir_cmd
  19   changed_when: false
  20   check_mode: no
  21 - name: check existing secret key
  22   shell: "gpg --list-secret-keys | grep '{{ gpg_useremail }}'"
  23   changed_when: false
  24   ignore_errors: true
  25   register: gpgkeys
  26   check_mode: no
  27 - name: Ask for gpg password
  28   when: gpgkeys.stdout == ""
  29   block:
  30     - name: Ask for gpg password
  31       pause:
  32         prompt: "Chose gpg password"
  33         echo: false
  34       register: gpg_password
  35     - name: Confirm gpg password
  36       pause:
  37         prompt: "Confirm gpg password"
  38         echo: false
  39       register: gpg_password_confirm
  40     - name: check gpg password
  41       assert:
  42         that: gpg_password_confirm.user_input == gpg_password.user_input
  43 - name: Generate gpg key
  44   when: gpgkeys.stdout == ""
  45   block:
  46     - name: Copy default template for gpg key generation
  47       template:
  48         src: gen-key-script.j2
  49         dest: "$XDG_CONFIG_HOME/gnupg/gen-key-script-{{ gpg_user }}"
  50         mode: 0600
  51       no_log: true
  52     - name: Generate gpg key
  53       command: "gpg --batch --gen-key $XDG_CONFIG_HOME/gnupg/gen-key-script-{{ gpg_user }}"
  54       register: genkey
  55   always:
  56     - name: Remove template file
  57       file:
  58         path: "$XDG_CONFIG_HOME/gnupg/gen-key-script-{{ gpg_user }}"
  59         state: absent
  60 - name: get keygrip
  61   shell: "gpg -K --with-colons {{ gpg_useremail }} | grep '^grp' | cut -d':' -f10"
  62   register: keygrip
  63   when: gpgkeys.stdout == ""
  64   notify:
  65     - notify add key to immae@immae.eu
  66     - send key to immae@immae.eu
  67     - notify add key to password store
  68 - meta: flush_handlers
  69 - name: add keygrip to sshcontrol
  70   lineinfile:
  71     line: "{{ keygrip.stdout }}"
  72     insertafter: EOF
  73     dest: "$XDG_CONFIG_HOME/gnupg/sshcontrol"
  74     create: true
  75     state: present
  76   when: keygrip is defined and "stdout" in keygrip and keygrip.stdout != ""
  77   notify:
  78     - restart gpg-agent
  79 - meta: flush_handlers
  80 - name: Override the gpg socket directory
  81   block:
  82     - name: Add systemd overrides
  83       template:
  84         src: "systemd/{{ systemd_item }}.conf.j2"
  85         dest: "$XDG_CONFIG_HOME/systemd/user/{{ systemd_item }}.socket.d/override.conf"
  86       register: results
  87       loop:
  88         - dirmngr
  89         - gpg-agent
  90         - gpg-agent-browser
  91         - gpg-agent-extra
  92         - gpg-agent-ssh
  93       loop_control:
  94         loop_var: systemd_item
  95     - name: Restart systemd units
  96       systemd:
  97         daemon_reload: true
  98         scope: user
  99         state: restarted
 100         name: "{{ restart_systemd_item }}.socket"
 101       loop: "{{ results.results|selectattr('changed')|map(attribute='item')|list }}"
 102       loop_control:
 103         loop_var: restart_systemd_item