Run Ansible from CI with a dedicated ci user - #27

Runs the Ansible playbook from GitHub Actions as a dedicated ci user, keeping CI auth and logging separate from human access.

Changes

• New users role (first play in playbook.yaml):
  • Creates the ci automation user: locked password, repo-managed authorized key (files/ci_ed25519.pub, exclusive: true), and NOPASSWD: ALL sudo via a visudo-validated /etc/sudoers.d/ci.
  • Creates the letsbuilda service user (system user, nologin, docker group) — previously consumed by the minecraft role but never created anywhere.
• ansible-deploy.yaml workflow: runs the playbook on pushes to main touching ansible/** (plus workflow_dispatch), gated by an ansible GitHub Environment. Connects as ci (ANSIBLE_REMOTE_USER), keeps strict host-key checking via the committed ansible/known_hosts, and queues (not cancels) overlapping runs via a concurrency group.
• New ansible-lint job in lint.yaml: ansible-lint + ansible-playbook --syntax-check on PRs and main — the existing ansible/.ansible-lint config was never actually installed or run in CI before. No secrets on PR-triggered runs.
• Cleanup: dropped vault_password_file from ansible.cfg (pointed at a nonexistent file and would abort non-interactive runs; vault is unused), added .gitignore for it. become_ask_pass = yes stays for humans; CI overrides via env.
• Docs: local runs, CI deploys, and the bootstrap/key-rotation procedure in docs/ansible.md, linked from the README.

Remaining setup before the first CI deploy

1. Create the ansible GitHub Environment, restrict its deployment branches to main, and add the SSH_PRIVATE_KEY secret (the counterpart to the committed ci_ed25519.pub).
2. One local bootstrap run of the playbook to create the ci user on microwave (chicken-and-egg — documented in docs/ansible.md).

Verification

• ansible-lint passes at the production profile; playbook syntax check passes; all pre-commit hooks pass (zizmor clean in offline mode on both new/modified workflows).
• Committed key material sanity-checked: both the CI public key and the pinned host key decode as valid ed25519 blobs, are distinct, and sit in the files the role/workflow read.

🤖 Generated with Claude Code

https://claude.ai/code/session_0131bYS1tMnLNHUJYQy8HwEW

Generated by Claude Code