deploy-homarr: connect as ansible user via Infisical deploy key (not root)

playbooks/deploy-homarr.yml

@@ -51,9 +51,17 @@
           - infisical_secrets.secrets.HOMARR_SECRET_ENCRYPTION_KEY | length == 64
         fail_msg: "HOMARR_SECRET_ENCRYPTION_KEY missing or not 64 hex chars in env '{{ infisical_env_slug }}'."
 
-    - name: "[precheck] stash for deploy play"
+    - name: "[precheck] stash secrets for deploy play"
       ansible.builtin.set_fact:
         pc_homarr_key: "{{ infisical_secrets.secrets.HOMARR_SECRET_ENCRYPTION_KEY }}"
+        pc_ssh_privkey: "{{ infisical_secrets.secrets.SSH_PRIVATE_KEY }}"
+      no_log: true
+
+    - name: "[precheck] write deploy private key to runner temp (0600)"
+      ansible.builtin.copy:
+        dest: "/tmp/homarr_deploy_key"
+        content: "{{ pc_ssh_privkey }}\n"
+        mode: "0600"
       no_log: true
 
     - name: "[precheck] OK"
@@ -70,7 +78,10 @@
     homarr_port: 7575
     homarr_image: ghcr.io/homarr-labs/homarr:latest
     homarr_encryption_key: "{{ hostvars['localhost'].pc_homarr_key }}"
-    ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new"
+    # Connect AS the ansible user (created by bootstrap) using the deploy key. NOT root.
+    ansible_user: ansible
+    ansible_ssh_private_key_file: "/tmp/homarr_deploy_key"
+    ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes"
   tasks:
     - name: Docker available?
       ansible.builtin.command: docker version
@@ -129,3 +140,12 @@
     - name: Result
       ansible.builtin.debug:
         msg: "Homarr up on {{ inventory_hostname }}:{{ homarr_port }} (HTTP {{ health.status }})"
+
+- name: "Cleanup runner temp key"
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: "remove temp deploy key from runner"
+      ansible.builtin.file:
+        path: /tmp/homarr_deploy_key
+        state: absent