Add a role for deploying infrastructure authorized keys and use it

inventories/chaosknoten/hosts.yaml

@@ -55,3 +55,11 @@ all:
         keycloak:
         wiki:
         onlyoffice:
+    infrastructure_authorized_keys_hosts:
+      hosts:
+        cloud:
+        pad:
+        public-reverse-proxy:
+        keycloak:
+        wiki:
+        onlyoffice:

inventories/z9/hosts.yaml

@@ -59,3 +59,11 @@ all:
     docker_compose_hosts:
       hosts:
         uptime-kuma:
+    infrastructure_authorized_keys_hosts:
+      hosts:
+        light:
+        mqtt:
+        zigbee2mqtt:
+        authoritative-dns:
+        mailserver-endpoint:
+        uptime-kuma:

playbooks/deploy.yaml

@@ -7,6 +7,11 @@
   roles:
     - deploy_ssh_server_config
 
+- name: Ensure deployment of infrastructure authorized keys
+  hosts: infrastructure_authorized_keys_hosts
+  roles:
+    - infrastructure_authorized_keys
+
 - name: Ensure Nextcloud config
   hosts: nextcloud_hosts
   roles:

playbooks/roles/infrastructure_authorized_keys/README.md

@@ -0,0 +1,3 @@
+# Role `infrastructure_authorized_keys`
+
+A role for deploying the infrastructure authorized keys from [this repo](https://gitlab.hamburg.ccc.de/ccchh/infrastructure-authorized-keys).

playbooks/roles/infrastructure_authorized_keys/tasks/main.yaml

@@ -0,0 +1,7 @@
+- name: deploy infrastructure authorized keys
+  ansible.posix.authorized_key:
+    state: present
+    user: chaos
+    exclusive: true
+    key: https://gitlab.hamburg.ccc.de/ccchh/infrastructure-authorized-keys/-/raw/trunk/authorized_keys?ref_type=heads&inline=false
+