# Infrahub — Unified Run Instructions (Talent / Accounting / IT)

This file describes the single, repeatable workflow for provisioning any department workstation using the Infrahub playbooks. The commands are written so you can copy/paste during a demo or include them in your README/runbook. Where departments differ, the file shows the small changes you must make (playbook name, inventory limit, and department variable file).

Summary (what to do)
- Prepare control machine (SSH key, Ansible installed).
- Edit inventory.ini with host IP(s) and login user.
- Put the target user's public key into the appropriate group_vars file.
- Dry-run (--check) the chosen playbook.
- Run the real playbook.
- Verify the results with the verification commands.

Prerequisites (control machine)
- Ansible installed (recommended v2.14+).
- A private SSH key for connecting to targets (example: ~/.ssh/infrahub_deploy).
- Inventory file: `inventory.ini`.
- Group vars: `group_vars/all.yml` or per-department files (`group_vars/talent.yml`, `group_vars/accounting.yml`, `group_vars/it.yml`).

Example inventory.ini (recommended pattern)
Replace <IP> and <login> with real values.

[ talent ]
talent1 ansible_host=192.168.0.10 ansible_user=ubuntu ansible_ssh_private_key_file=~/.ssh/infrahub_deploy

[ accounting ]
accounting1 ansible_host=192.168.0.11 ansible_user=ubuntu ansible_ssh_private_key_file=~/.ssh/infrahub_deploy

[ it ]
it1 ansible_host=192.168.0.12 ansible_user=ubuntu ansible_ssh_private_key_file=~/.ssh/infrahub_deploy

Notes:
- You can set ansible_ssh_private_key_file per-host as above, or pass --private-key when running ansible-playbook.

Example group_vars (single canonical file or per-dept)
Use the public key text (single line) in ssh_pub_key. Example `group_vars/all.yml`:

it_user: "meganr"
ssh_pub_key: "ssh-ed25519 AAAA... your_pub_key_comment"

If you use per-department vars, name the variable the playbook expects (e.g., talent_user / accounting_user / it_user). Inspect the playbooks/roles for exact variable names if in doubt.

Creating a keypair (control machine)
# create ed25519 key (no passphrase)
eval "$(ssh-agent -s)"
ssh-keygen -t ed25519 -f ~/.ssh/infrahub_deploy -C "infrahub_deploy" -N ""
ssh-add ~/.ssh/infrahub_deploy
cat ~/.ssh/infrahub_deploy.pub   # copy this into group_vars/<file>.yml or authorized_keys on the VM

Unified run commands (dry-run, then apply)
Replace <dept> with `talent`, `accounting`, or `it`, and replace <host-limit> with the host or group you want to run against (e.g., talent1, accounting1, it1, or whole group talent/accounting/it).

Dry-run (preview changes; recommended)
ansible-playbook \
  -i inventory.ini \
  playbooks/<dept>.yml \
  --limit <host-limit> \
  --check --diff -v \
  --private-key=~/.ssh/infrahub_deploy \
  --become --ask-become-pass

Real apply (actual provisioning)
ansible-playbook \
  -i inventory.ini \
  playbooks/<dept>.yml \
  --limit <host-limit> \
  -v \
  --private-key=~/.ssh/infrahub_deploy \
  --become --ask-become-pass

Examples
- Run Talent playbook on single host `talent1`:
  ansible-playbook -i inventory.ini playbooks/talent.yml --limit talent1 --check --diff -v --private-key=~/.ssh/infrahub_deploy --become --ask-become-pass

  ansible-playbook -i inventory.ini playbooks/talent.yml --limit talent1 -v --private-key=~/.ssh/infrahub_deploy --become --ask-become-pass

- Run IT playbook on host `it1`:
  ansible-playbook -i inventory.ini playbooks/it.yml --limit it1 --check --diff -v --private-key=~/.ssh/infrahub_deploy --become --ask-become-pass

  ansible-playbook -i inventory.ini playbooks/it.yml --limit it1 -v --private-key=~/.ssh/infrahub_deploy --become --ask-become-pass

Small differences by department (what to change)
- Playbook file: `playbooks/talent.yml` vs `playbooks/accounting.yml` vs `playbooks/it.yml`.
- Inventory limit: use the host/group in the `--limit` flag (e.g., talent1, accounting1, it1, or the group name to run for many).
- Variable file: edit `group_vars/all.yml` for global variables or `group_vars/talent.yml` etc. for per-department values — ensure the username variable matches what the playbook expects (e.g., `it_user` vs `talent_user`).
- Tags (optional): playbooks may support tags like `--tags "user,packages"` — use tags to run only parts of a playbook.

Verification (common checks after provisioning)
Replace <dept_user> and <host> accordingly.

- Confirm user exists:
  ansible -i inventory.ini <host> -m command -a "id <dept_user>" --become -v

- Check authorized_keys and permissions:
  ansible -i inventory.ini <host> -m command -a "stat -c '%U %G %a %n' /home/<dept_user> /home/<dept_user>/.ssh /home/<dept_user>/.ssh/authorized_keys" --become -v
  ansible -i inventory.ini <host> -m command -a "cat /home/<dept_user>/.ssh/authorized_keys" --become -v

- Check a service (example: docker):
  ansible -i inventory.ini <host> -m command -a "docker --version" --become -v
  ansible -i inventory.ini <host> -m service -a "name=docker state=started" --become -v

- Re-run playbook to check idempotence:
  ansible-playbook -i inventory.ini playbooks/<dept>.yml --limit <host> -v --private-key=~/.ssh/infrahub_deploy --become --ask-become-pass
  Expect most tasks to show changed=0.

Check-mode caveats
- Some tasks are intentionally skipped in --check (e.g., adding authorized keys, starting services, downloads). Playbooks include guards like `when: not ansible_check_mode`. A successful `--check` gives confidence but does not guarantee those guarded tasks will succeed when run for real — verify them after a real apply.

Best practices and tips
- Never commit private keys or vault secrets to the repo. Add patterns to `.gitignore` (e.g., `.ssh/*.pem`, `.ssh/infrahub_deploy`).
- Use Ansible Vault for any secrets (passwords, tokens).
- Use per-host `ansible_ssh_private_key_file` or pass `--private-key` to avoid exposing keys in inventory.
- Add tags to playbooks/roles so you can run `--tags user` to only create users, or `--tags packages` to install packages.
- For bulk provisioning, use `--forks` and group limits: e.g.,
  ansible-playbook -i inventory.ini playbooks/talent.yml --limit talent -f 50 --private-key=~/.ssh/infrahub_deploy --become

Troubleshooting quick wins
- "Permission denied (publickey)" when pushing/pulling Git: ensure the SSH key is added to GitHub or use HTTPS with a PAT.
- "Connection refused" on SSH: install/enable sshd and open firewall on the target.
- "Conflicting Signed-By" apt error: run the preflight normalization tasks included in the roles or ensure keyring paths are consistent.
- If a task fails due to a missing package manager dependency (python), bootstrap Python using raw/apt tasks before running Ansible fully.

Quick checklist (copy for demo)
- [ ] Inventory updated with host IPs and ansible_user.
- [ ] Control key created and available (~/.ssh/infrahub_deploy).
- [ ] Public key added to `group_vars/...` (ssh_pub_key) or to target authorized_keys.
- [ ] Dry-run with `--check` for chosen playbook and host.
- [ ] Real run and verification commands executed.
- [ ] Re-run for idempotence.

Appendix: common command snippets
- Add SSH key to inventory host entry:
  sed -i "s|ansible_ssh_private_key_file=.*|ansible_ssh_private_key_file=~/.ssh/infrahub_deploy|" inventory.ini

- Fetch remote authorized_keys and write to group_vars/all.yml (utility playbook also exists: playbooks/fetch_pubkey.yml)
  ansible -i inventory.ini it1 -m shell -a "sed -n '1p' /home/infrahub/.ssh/authorized_keys" --become -v

If you need, I can:
- produce a `scripts/verify_post_provision.sh` that implements the verification checks above, or
- create a single example `group_vars/talent.yml` and `group_vars/it.yml` with placeholder values to include in the repo.

End of instructions.