feat(deploy): aibook.fun deploy layer (terraform + ansible + docker on DO)

deploy/ansible.cfg

@@ -0,0 +1,33 @@
+# Ansible settings for deploying aibook-fun.
+#
+# The whole point of this file is SSH connection reuse. On a workstation whose
+# SSH key lives in a hardware-backed agent (Secretive, a YubiKey, the Secure
+# Enclave), every *new* TCP connection needs a fresh signature — which means a
+# Touch ID prompt. Ansible opens many connections per run and does so
+# non-interactively, so those prompts cannot be answered and the run dies with:
+#
+#     sign_and_send_pubkey: signing failed ... agent refused operation
+#
+# Ansible's own defaults make this worse in two ways, both fixed below:
+#
+#   1. It keeps control sockets in ~/.ansible/cp, separate from the ones the
+#      operator's own `ssh` has already authenticated. Pointing it at the same
+#      directory and the same %C naming as OpenSSH means ansible *reuses* a
+#      master connection the operator authorised earlier — no new signature.
+#   2. ControlPersist defaults to 60s, so a master closes between steps of a
+#      deploy and the next one needs another signature.
+#
+# Together: authenticate once at the start of a work session, then deploy
+# repeatedly without touching the key again.
+[defaults]
+host_key_checking = True
+interpreter_python = auto_silent
+
+[ssh_connection]
+# Match OpenSSH's own ControlPath so ansible shares the operator's masters.
+# %%C is escaped for configparser — ssh receives %C (a hash of local host,
+# remote host, port and user), exactly what ~/.ssh/config uses.
+control_path_dir = ~/.ssh/sockets
+control_path = %(directory)s/%%C
+ssh_args = -C -o ControlMaster=auto -o ControlPersist=4h
+pipelining = True