From 4481c202a53bf55ece9f537e988b23f6ae58fcc5 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Thu, 2 Apr 2026 15:07:28 -0400
Subject: [PATCH] Add playbooks/bootstrap.yml

---
 playbooks/bootstrap.yml | 74 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 playbooks/bootstrap.yml

diff --git a/playbooks/bootstrap.yml b/playbooks/bootstrap.yml
new file mode 100644
index 0000000..bcf183d
--- /dev/null
+++ b/playbooks/bootstrap.yml
@@ -0,0 +1,74 @@
+---
+- name: Bootstrap new Linux host for Semaphore management
+  hosts: all
+  become: true
+  become_method: sudo
+
+  vars:
+    deploy_user: deploy
+    deploy_pub_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFl9c6X1OWgfd7M3BCR689cKEMsZf5X7N6Jcp4EoZ5fj semaphore@wulf"
+
+  tasks:
+    - name: Create deploy user
+      ansible.builtin.user:
+        name: "{{ deploy_user }}"
+        shell: /bin/bash
+        create_home: true
+        state: present
+
+    - name: Ensure .ssh directory exists
+      ansible.builtin.file:
+        path: "/home/{{ deploy_user }}/.ssh"
+        state: directory
+        owner: "{{ deploy_user }}"
+        group: "{{ deploy_user }}"
+        mode: '0700'
+
+    - name: Install authorized key
+      ansible.posix.authorized_key:
+        user: "{{ deploy_user }}"
+        key: "{{ deploy_pub_key }}"
+        state: present
+
+    - name: Grant passwordless sudo via sudoers.d
+      ansible.builtin.copy:
+        dest: "/etc/sudoers.d/{{ deploy_user }}"
+        content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
+        mode: '0440'
+        validate: /usr/sbin/visudo -cf %s
+
+    - name: Disable SSH password authentication
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+      notify: Restart sshd
+
+    - name: Ensure python3 is present
+      ansible.builtin.package:
+        name: python3
+        state: present
+
+    - name: Install common baseline packages
+      ansible.builtin.package:
+        name:
+          - curl
+          - wget
+          - git
+          - unzip
+          - htop
+          - ca-certificates
+          - gnupg
+        state: present
+        update_cache: true
+
+    - name: Set timezone to America/New_York
+      community.general.timezone:
+        name: America/New_York
+
+  handlers:
+    - name: Restart sshd
+      ansible.builtin.service:
+        name: "{{ 'ssh' if ansible_distribution == 'Ubuntu' else 'sshd' }}"
+        state: restarted
\ No newline at end of file