idk

ansible/README.md

@@ -28,10 +28,31 @@ cd ansible
 ansible-galaxy collection install -r requirements.yml
 ```
 
+## Bootstrap (once per fresh VPS)
+
+`bootstrap.yml` connects as **root** (it overrides whatever `ansible_user`
+the inventory has), creates the `ansible` automation user — SSH key only,
+locked password, passwordless sudo — *proves the new user can log in and
+sudo* in a second play, and only then locks sshd down: key-only auth
+(`PasswordAuthentication no`) and **root SSH login disabled**
+(`PermitRootLogin no`). Break-glass access after that is the provider's
+console, not SSH:
+
+```bash
+cp inventory.example.yml inventory.yml
+ansible-playbook bootstrap.yml            # root already has your key
+ansible-playbook bootstrap.yml -k         # root password login (needs sshpass)
+# custom key or username:
+ansible-playbook bootstrap.yml -e bootstrap_ssh_public_key_file=~/.ssh/vpnhub.pub
+```
+
+Everything after this runs as `ansible` (already the inventory example's
+default).
+
 ## First-time setup
 
 ```bash
-cp inventory.example.yml inventory.yml            # set host/user
+cp inventory.example.yml inventory.yml            # set host/user (if not done above)
 cp group_vars/vpnhub.example.yml group_vars/vpnhub.yml
 $EDITOR group_vars/vpnhub.yml                     # DC IPs, Duo keys, secrets
 ansible-vault encrypt group_vars/vpnhub.yml       # both files are gitignored anyway