feat: provision kolibri automation user

Justfile

@@ -17,6 +17,7 @@ tofu-destroy: tofu-init
     tofu -chdir={{ opentofu_dir }} apply -auto-approve -destroy
 
 ansible-run-playbook:
+    ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/playbooks/provision.yaml -e ansible_user=root
     ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/site.yaml
 
 get-admin-conf:

ansible/inventories/incus/group_vars/all.yaml

@@ -1 +1,2 @@
 ansible_python_interpreter: /usr/bin/python3
+ansible_user: kolibri

ansible/playbooks/provision.yaml

@@ -0,0 +1,24 @@
+- name: Provision kolibri automation user
+  hosts: all
+  become: true
+  tasks:
+    - name: Ensure Kolibri user exists
+      ansible.builtin.user:
+        name: kolibri
+        comment: Hummingbird
+        create_home: true
+        groups:
+          - sudo
+        shell: /bin/bash
+
+    - name: Ensure authorised keys for Kolibri
+      ansible.posix.authorized_key:
+        user: kolibri
+        key: "{{ lookup('proton_pass', vault_name='Home Lab', item_title='Kolibri Automation', field='Public key') }}"
+
+    - name: Allow passwordless sudo for Kolibri
+      ansible.builtin.copy:
+        content: "kolibri ALL=(ALL) NOPASSWD: ALL\n"
+        dest: /etc/sudoers.d/kolibri
+        mode: "0440"
+        validate: visudo -cf %s