From b17ab6c8bba9f78a9d012d9ed627e311bdf58a4e Mon Sep 17 00:00:00 2001
From: James Allenby <JamesAllenby@protonmail.com>
Date: Sun, 28 Jun 2026 23:20:59 +0100
Subject: [PATCH] feat: provision kolibri automation user

---
 Justfile                                      |  1 +
 .../incus}/group_vars/all.yaml                |  1 +
 ansible/playbooks/provision.yaml              | 24 +++++++++++++++++++
 3 files changed, 26 insertions(+)
 rename ansible/{ => inventories/incus}/group_vars/all.yaml (67%)
 create mode 100644 ansible/playbooks/provision.yaml

diff --git a/Justfile b/Justfile
index dbe872c..0badf89 100644
--- a/Justfile
+++ b/Justfile
@@ -17,6 +17,7 @@ tofu-destroy: tofu-init
     tofu -chdir={{ opentofu_dir }} apply -auto-approve -destroy
 
 ansible-run-playbook:
+    ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/playbooks/provision.yaml -e ansible_user=root
     ansible-playbook -i ansible/inventories/incus/incus.yaml -c community.general.incus ansible/site.yaml
 
 get-admin-conf:
diff --git a/ansible/group_vars/all.yaml b/ansible/inventories/incus/group_vars/all.yaml
similarity index 67%
rename from ansible/group_vars/all.yaml
rename to ansible/inventories/incus/group_vars/all.yaml
index f1a3ed4..294f47f 100644
--- a/ansible/group_vars/all.yaml
+++ b/ansible/inventories/incus/group_vars/all.yaml
@@ -1 +1,2 @@
 ansible_python_interpreter: /usr/bin/python3
+ansible_user: kolibri
diff --git a/ansible/playbooks/provision.yaml b/ansible/playbooks/provision.yaml
new file mode 100644
index 0000000..c185164
--- /dev/null
+++ b/ansible/playbooks/provision.yaml
@@ -0,0 +1,24 @@
+- name: Provision kolibri automation user
+  hosts: all
+  become: true
+  tasks:
+    - name: Ensure Kolibri user exists
+      ansible.builtin.user:
+        name: kolibri
+        comment: Hummingbird
+        create_home: true
+        groups:
+          - sudo
+        shell: /bin/bash
+
+    - name: Ensure authorised keys for Kolibri
+      ansible.posix.authorized_key:
+        user: kolibri
+        key: "{{ lookup('proton_pass', vault_name='Home Lab', item_title='Kolibri Automation', field='Public key') }}"
+
+    - name: Allow passwordless sudo for Kolibri
+      ansible.builtin.copy:
+        content: "kolibri ALL=(ALL) NOPASSWD: ALL\n"
+        dest: /etc/sudoers.d/kolibri
+        mode: "0440"
+        validate: visudo -cf %s