From 03cbaaef3a79efa03efbfda81abfaab8ab80da34 Mon Sep 17 00:00:00 2001 From: Sam Date: Wed, 26 Aug 2026 14:53:19 -0400 Subject: [PATCH] bootstrap: connect as root via deploy SSH key (racknerd uses PermitRootLogin without-password) --- playbooks/bootstrap.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/playbooks/bootstrap.yml b/playbooks/bootstrap.yml index bdb6f21..f235963 100644 --- a/playbooks/bootstrap.yml +++ b/playbooks/bootstrap.yml @@ -106,9 +106,11 @@ managed_user: ansible new_hostname: "{{ new_hostname | default('racknerd1') }}" ansible_user: "{{ connect_user | default('root') }}" - ansible_password: "{{ hostvars['localhost'].pc_root_pass }}" - ansible_become_password: "{{ hostvars['localhost'].pc_root_pass }}" - ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new" + # Connect as root using the deploy SSH key (written to the runner temp file in precheck). + # racknerd-class hosts use PermitRootLogin without-password, so password auth won't work; + # the deploy key must already be in root's authorized_keys (one-time seeding). + ansible_ssh_private_key_file: "/tmp/bootstrap_deploy_key" + ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes" managed_ssh_pubkey: "{{ hostvars['localhost'].pc_ssh_pubkey }}" managed_user_password: "{{ hostvars['localhost'].pc_user_pass }}" cleanup_paths: []