From 22ffe2f617772a7ab70fe255d3ca5d09be8dea97 Mon Sep 17 00:00:00 2001
From: Chewbaccalakis <nick@trochalakis.com>
Date: Wed, 15 Jul 2026 21:22:15 -0700
Subject: [PATCH] idk

---
 ansible/bootstrap.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/ansible/bootstrap.yml b/ansible/bootstrap.yml
index 2e5dcaa..fd3ad77 100644
--- a/ansible/bootstrap.yml
+++ b/ansible/bootstrap.yml
@@ -3,9 +3,10 @@
 # later run uses — key-only auth, passwordless sudo — verify it actually
 # works, then lock sshd down to keys. Run once per fresh VPS:
 #
-#   ansible-playbook bootstrap.yml          # root already has your key
-#   ansible-playbook bootstrap.yml -k       # root still uses a password
-#                                           # (needs sshpass installed)
+#   ansible-playbook bootstrap.yml
+#
+# It prompts for the root SSH password (needs sshpass on the control
+# node). If root already authenticates with your key, just press Enter.
 #
 # Afterwards set `ansible_user: ansible` in inventory.yml and never
 # connect as root again. Overridable with -e:
@@ -22,10 +23,16 @@
 - name: Create the automation user (connects as root)
   hosts: vpnhub
   gather_facts: false
+  vars_prompt:
+    - name: bootstrap_root_password
+      prompt: "Root SSH password (Enter if root already uses your key)"
+      private: true
+      default: ""
   vars:
     ansible_user: root          # play var — outranks inventory on purpose
+    ansible_password: "{{ bootstrap_root_password }}"
     bootstrap_user: ansible
-    bootstrap_ssh_public_key_file: "~/.ssh/id_ed25519.pub"
+    bootstrap_ssh_public_key_file: "~/.ssh/togo-ansible.pub"
   tasks:
     - name: Create the user (no password hash set, account password locked)
       ansible.builtin.user: