idk

ansible/bootstrap.yml

@@ -3,9 +3,10 @@
 # later run uses — key-only auth, passwordless sudo — verify it actually
 # works, then lock sshd down to keys. Run once per fresh VPS:
 #
-#   ansible-playbook bootstrap.yml          # root already has your key
-#   ansible-playbook bootstrap.yml -k       # root still uses a password
-#                                           # (needs sshpass installed)
+#   ansible-playbook bootstrap.yml
+#
+# It prompts for the root SSH password (needs sshpass on the control
+# node). If root already authenticates with your key, just press Enter.
 #
 # Afterwards set `ansible_user: ansible` in inventory.yml and never
 # connect as root again. Overridable with -e:
@@ -22,10 +23,16 @@
 - name: Create the automation user (connects as root)
   hosts: vpnhub
   gather_facts: false
+  vars_prompt:
+    - name: bootstrap_root_password
+      prompt: "Root SSH password (Enter if root already uses your key)"
+      private: true
+      default: ""
   vars:
     ansible_user: root          # play var — outranks inventory on purpose
+    ansible_password: "{{ bootstrap_root_password }}"
     bootstrap_user: ansible
-    bootstrap_ssh_public_key_file: "~/.ssh/id_ed25519.pub"
+    bootstrap_ssh_public_key_file: "~/.ssh/togo-ansible.pub"
   tasks:
     - name: Create the user (no password hash set, account password locked)
       ansible.builtin.user: