# Ansible settings for deploying aibook-fun.
#
# The whole point of this file is SSH connection reuse. On a workstation whose
# SSH key lives in a hardware-backed agent (Secretive, a YubiKey, the Secure
# Enclave), every *new* TCP connection needs a fresh signature — which means a
# Touch ID prompt. Ansible opens many connections per run and does so
# non-interactively, so those prompts cannot be answered and the run dies with:
#
#     sign_and_send_pubkey: signing failed ... agent refused operation
#
# Ansible's own defaults make this worse in two ways, both fixed below:
#
#   1. It keeps control sockets in ~/.ansible/cp, separate from the ones the
#      operator's own `ssh` has already authenticated. Pointing it at the same
#      directory and the same %C naming as OpenSSH means ansible *reuses* a
#      master connection the operator authorised earlier — no new signature.
#   2. ControlPersist defaults to 60s, so a master closes between steps of a
#      deploy and the next one needs another signature.
#
# Together: authenticate once at the start of a work session, then deploy
# repeatedly without touching the key again.
[defaults]
host_key_checking = True
interpreter_python = auto_silent

[ssh_connection]
# Match OpenSSH's own ControlPath so ansible shares the operator's masters.
# %%C is escaped for configparser — ssh receives %C (a hash of local host,
# remote host, port and user), exactly what ~/.ssh/config uses.
control_path_dir = ~/.ssh/sockets
control_path = %(directory)s/%%C
ssh_args = -C -o ControlMaster=auto -o ControlPersist=4h
pipelining = True