34 lines
1.6 KiB
INI
34 lines
1.6 KiB
INI
# Ansible settings for deploying aibook-fun.
|
|
#
|
|
# The whole point of this file is SSH connection reuse. On a workstation whose
|
|
# SSH key lives in a hardware-backed agent (Secretive, a YubiKey, the Secure
|
|
# Enclave), every *new* TCP connection needs a fresh signature — which means a
|
|
# Touch ID prompt. Ansible opens many connections per run and does so
|
|
# non-interactively, so those prompts cannot be answered and the run dies with:
|
|
#
|
|
# sign_and_send_pubkey: signing failed ... agent refused operation
|
|
#
|
|
# Ansible's own defaults make this worse in two ways, both fixed below:
|
|
#
|
|
# 1. It keeps control sockets in ~/.ansible/cp, separate from the ones the
|
|
# operator's own `ssh` has already authenticated. Pointing it at the same
|
|
# directory and the same %C naming as OpenSSH means ansible *reuses* a
|
|
# master connection the operator authorised earlier — no new signature.
|
|
# 2. ControlPersist defaults to 60s, so a master closes between steps of a
|
|
# deploy and the next one needs another signature.
|
|
#
|
|
# Together: authenticate once at the start of a work session, then deploy
|
|
# repeatedly without touching the key again.
|
|
[defaults]
|
|
host_key_checking = True
|
|
interpreter_python = auto_silent
|
|
|
|
[ssh_connection]
|
|
# Match OpenSSH's own ControlPath so ansible shares the operator's masters.
|
|
# %%C is escaped for configparser — ssh receives %C (a hash of local host,
|
|
# remote host, port and user), exactly what ~/.ssh/config uses.
|
|
control_path_dir = ~/.ssh/sockets
|
|
control_path = %(directory)s/%%C
|
|
ssh_args = -C -o ControlMaster=auto -o ControlPersist=4h
|
|
pipelining = True
|