From 399826fd634e47134feb919b0ee0805035475fc4 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Sun, 9 Nov 2025 00:23:04 +0100
Subject: Add password_store role

---
 configure.yml                                |   3 +++
 group_vars/all.yml                           | Bin 3669 -> 3723 bytes
 group_vars/all.yml.example                   |   2 ++
 roles/password_store/meta/argument_specs.yml |  10 ++++++++++
 roles/password_store/meta/main.yml           |  19 +++++++++++++++++++
 roles/password_store/tasks/main.yml          |  25 +++++++++++++++++++++++++
 roles/password_store/vars/archlinux.yml      |   4 ++++
 roles/password_store/vars/debian.yml         |   4 ++++
 8 files changed, 67 insertions(+)
 create mode 100644 roles/password_store/meta/argument_specs.yml
 create mode 100644 roles/password_store/meta/main.yml
 create mode 100644 roles/password_store/tasks/main.yml
 create mode 100644 roles/password_store/vars/archlinux.yml
 create mode 100644 roles/password_store/vars/debian.yml

diff --git a/configure.yml b/configure.yml
index 78d1569e..cbbff425 100644
--- a/configure.yml
+++ b/configure.yml
@@ -17,6 +17,7 @@
     - role: "rsync"
     - role: "gpg"
     - role: "dotfiles"
+    - role: "password_store"
 
 - name: "Ubuntu configure"
   gather_facts: true
@@ -37,6 +38,7 @@
     - role: "rsync"
     - role: "gpg"
     - role: "dotfiles"
+    - role: "password_store"
 
 - name: "Raspberry Pi configure"
   gather_facts: true
@@ -55,3 +57,4 @@
     - role: "grafana"
     - role: "gpg"
     - role: "dotfiles"
+    - role: "password_store"
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 3442025a..c23828a6 100644
Binary files a/group_vars/all.yml and b/group_vars/all.yml differ
diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example
index 88974f6a..166fee3c 100644
--- a/group_vars/all.yml.example
+++ b/group_vars/all.yml.example
@@ -46,6 +46,8 @@ dotfiles_setup_script: |
   chmod 0700 ~/.gnupg
   git remote set-url origin git@git.sr.ht:~a14m/.rc
 
+password_store_repo_url: "git@github.com:a14m/.pass"
+
 wireguard_autostart_connection: "wg-vpn0"
 wireguard_connections:
   wg-vpn0: |
diff --git a/roles/password_store/meta/argument_specs.yml b/roles/password_store/meta/argument_specs.yml
new file mode 100644
index 00000000..4626f0d8
--- /dev/null
+++ b/roles/password_store/meta/argument_specs.yml
@@ -0,0 +1,10 @@
+---
+argument_specs:
+  main:
+    short_description: "Configure pass for unix (password store)"
+    description: "Configure pass for unix (password store)"
+    options:
+      password_store_repo_url:
+        type: "str"
+        description: "The password store git repo URL"
+        required: true
diff --git a/roles/password_store/meta/main.yml b/roles/password_store/meta/main.yml
new file mode 100644
index 00000000..7dc74b37
--- /dev/null
+++ b/roles/password_store/meta/main.yml
@@ -0,0 +1,19 @@
+---
+dependencies:
+  - role: "git"
+galaxy_info:
+  author: "a14m"
+  description: "Configure pass for unix (password store)"
+  company: "kartoffeln.work GmbH."
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/password_store/tasks/main.yml b/roles/password_store/tasks/main.yml
new file mode 100644
index 00000000..72df297a
--- /dev/null
+++ b/roles/password_store/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+- name: "Include OS-specific variables"
+  ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml"
+
+- name: "Ensure pass packages are installed"
+  become: true
+  ansible.builtin.package:
+    name: "{{ password_store_packages }}"
+    state: "present"
+
+- name: "Add GitHub to known_hosts"
+  ansible.builtin.known_hosts:
+    name: "github.com"
+    key: "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
+    path: "{{ ansible_env.HOME }}/.ssh/known_hosts"
+    state: present
+
+- name: "Clone password store git repo"
+  ansible.builtin.git:
+    repo: "{{ password_store_repo_url }}"
+    dest: "{{ ansible_env.HOME }}/.password-store"
+    clone: true
+    update: false
+    single_branch: true
+    version: main
diff --git a/roles/password_store/vars/archlinux.yml b/roles/password_store/vars/archlinux.yml
new file mode 100644
index 00000000..ad2bce28
--- /dev/null
+++ b/roles/password_store/vars/archlinux.yml
@@ -0,0 +1,4 @@
+---
+password_store_packages:
+  - "pass"
+  - "pass-otp"
diff --git a/roles/password_store/vars/debian.yml b/roles/password_store/vars/debian.yml
new file mode 100644
index 00000000..6cb452fc
--- /dev/null
+++ b/roles/password_store/vars/debian.yml
@@ -0,0 +1,4 @@
+---
+password_store_packages:
+  - "pass"
+  - "pass-extension-otp"
-- 
cgit v1.2.3