Add password_store role

8 files changed, 67 insertions, 0 deletions

diff --git a/configure.yml b/configure.yml
index 78d1569e..cbbff425 100644
--- a/configure.yml
+++ b/configure.yml
@@ -17,6 +17,7 @@
     - role: "rsync"
     - role: "gpg"
     - role: "dotfiles"
+    - role: "password_store"
 
 - name: "Ubuntu configure"
   gather_facts: true
@@ -37,6 +38,7 @@
     - role: "rsync"
     - role: "gpg"
     - role: "dotfiles"
+    - role: "password_store"
 
 - name: "Raspberry Pi configure"
   gather_facts: true
@@ -55,3 +57,4 @@
     - role: "grafana"
     - role: "gpg"
     - role: "dotfiles"
+    - role: "password_store"
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 3442025a..c23828a6 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example
index 88974f6a..166fee3c 100644
--- a/group_vars/all.yml.example
+++ b/group_vars/all.yml.example
@@ -46,6 +46,8 @@ dotfiles_setup_script: |
   chmod 0700 ~/.gnupg
   git remote set-url origin [email protected]:~a14m/.rc
 
+password_store_repo_url: "[email protected]:a14m/.pass"
+
 wireguard_autostart_connection: "wg-vpn0"
 wireguard_connections:
   wg-vpn0: |
diff --git a/roles/password_store/meta/argument_specs.yml b/roles/password_store/meta/argument_specs.yml
new file mode 100644
index 00000000..4626f0d8
--- /dev/null
+++ b/roles/password_store/meta/argument_specs.yml
@@ -0,0 +1,10 @@
+---
+argument_specs:
+  main:
+    short_description: "Configure pass for unix (password store)"
+    description: "Configure pass for unix (password store)"
+    options:
+      password_store_repo_url:
+        type: "str"
+        description: "The password store git repo URL"
+        required: true
diff --git a/roles/password_store/meta/main.yml b/roles/password_store/meta/main.yml
new file mode 100644
index 00000000..7dc74b37
--- /dev/null
+++ b/roles/password_store/meta/main.yml
@@ -0,0 +1,19 @@
+---
+dependencies:
+  - role: "git"
+galaxy_info:
+  author: "a14m"
+  description: "Configure pass for unix (password store)"
+  company: "kartoffeln.work GmbH."
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/password_store/tasks/main.yml b/roles/password_store/tasks/main.yml
new file mode 100644
index 00000000..72df297a
--- /dev/null
+++ b/roles/password_store/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+- name: "Include OS-specific variables"
+  ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
+
+- name: "Ensure pass packages are installed"
+  become: true
+  ansible.builtin.package:
+    name: "{{ password_store_packages }}"
+    state: "present"
+
+- name: "Add GitHub to known_hosts"
+  ansible.builtin.known_hosts:
+    name: "github.com"
+    key: "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
+    path: "{{ ansible_env.HOME }}/.ssh/known_hosts"
+    state: present
+
+- name: "Clone password store git repo"
+  ansible.builtin.git:
+    repo: "{{ password_store_repo_url }}"
+    dest: "{{ ansible_env.HOME }}/.password-store"
+    clone: true
+    update: false
+    single_branch: true
+    version: main
diff --git a/roles/password_store/vars/archlinux.yml b/roles/password_store/vars/archlinux.yml
new file mode 100644
index 00000000..ad2bce28
--- /dev/null
+++ b/roles/password_store/vars/archlinux.yml
@@ -0,0 +1,4 @@
+---
+password_store_packages:
+  - "pass"
+  - "pass-otp"
diff --git a/roles/password_store/vars/debian.yml b/roles/password_store/vars/debian.yml
new file mode 100644
index 00000000..6cb452fc
--- /dev/null
+++ b/roles/password_store/vars/debian.yml
@@ -0,0 +1,4 @@
+---
+password_store_packages:
+  - "pass"
+  - "pass-extension-otp"