Refactored git configuration tasks, converting them to lockdown role tasks, and replaced playbook prompt variables with lockdown role variabls

.ansible/roles/lockdown/defaults/main.yml

@@ -8,7 +8,9 @@ create_users:
 ssh_pubkey_filename_pattern: '.*\.pub'
 include_root_lock: yes
 gpg_private_keys_origin_host: localhost
+ssh_keypairs_origin_host: localhost
 gpg_origin_private_keyids: [] # @NOTE list of gpg key ids from origin or source server
 gpg_origin_private_key_passwords: "{{ vaulted_gpg_origin_private_key_passwords }}" # @NOTE list of gpg key passwords from origin or source server
+ssh_origin_keypairs_filenames: [] # @NOTE list of basenames (filename sans extension) of SSH keypairs
 git_config_name: ~ # @NOTE: has equivalent field under lockdown role vars example YAML file, but different value
 git_config_email: ~ # @NOTE: has equivalent field under lockdown role vars example YAML file, but different value

.ansible/roles/lockdown/tasks/git.yml

@@ -1,4 +1,4 @@
-# 'preferred_gpg_signing_key' -> 'gpg_preferred_signing'
+# 'preferred_signing_key' -> 'gpg_preferred_signing'
 # 'gpg_or_ssh_git_signing' -> 'git_signing_key_type'
 - name: Install git package
   ansible.builtin.package:
@@ -22,102 +22,107 @@
   when: git_signing_key_type == "gpg"
   block:
   - name: Configure specified git signing GPG key
-    when: preferred_gpg_signing_key > -1
+    when: preferred_signing_key > -1
     community.general.git_config:
       name: user.signingkey
       scope: global
       state: present
-      value: "{{ gpg_origin_private_keyids[preferred_gpg_signing_key] }}"
+      value: "{{ gpg_origin_private_keyids[preferred_signing_key] }}"
+    register: selected_signing_key
   - name: Configure random git signing GPG key
-    when: preferred_gpg_signing_key <= -1
+    when: preferred_signing_key <= -1
     community.general.git_config:
       name: user.signingkey
       scope: global
       state: present
       value: "{{ gpg_origin_private_keyids | random }}"
-    register: randomized_gpg_key_preference
+    register: selected_signing_key
 - name: Configure git signing SSH key
   when: git_signing_key_type == "ssh"
   block:
   - name: Acquire SSH key-pairs from other system
     when: not files_mode
     block:
-    - name: Acquire private SSH keys from other system
-      delegate_to: "{{ ssh_keypairs_origin_host }}" # @TODO variable needs declaration/definition
-      ansible.builtin.command:
-        argv:
-        - cat
-        - ~/.ssh/"{{ item }}.ppk"
-      loop: "{{ ssh_origin_keypairs_paths }}" # @TODO variable needs declaration/definition--should have max 2 items each without file extension, with private and then public keys having same basename
-      register: ssh_secrets
-    - name: Find SSH public keys in other system
-      delegate_to: "{{ ssh_keypairs_origin_host }}" # @TODO variable needs declaration/definition
-      ansible.builtin.command:
-        argv:
-        - cat
-        - ~/.ssh/"{{ item }}.pub"
-      loop: "{{ ssh_origin_keypairs_paths }}" # @TODO variable needs declaration/definition--should have max 2 items each without file extension, with private and then public keys having same basename
-      register: ssh_nonsecrets
-    - name: Create private SSH keys
-      ansible.builtin.copy:
-        content: "{{ item }}"
-        dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.ppk"
-        force: yes
-        backup: yes
-        mode: "0600"
-        state: present
-      loop: "{{ ssh_secrets.results }}"
-      register: created_ssh_private_keys
-    - name: Create public SSH keys
-      ansible.builtin.copy:
-        content: "{{ item }}"
-        dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.pub"
-        force: yes
-        backup: yes
-        mode: "0644"
-        state: present
-      loop: "{{ ssh_nonsecrets.results }}"
-      register: created_ssh_public_keys
+      - name: Acquire private SSH keys from other system
+        delegate_to: "{{ ssh_keypairs_origin_host }}"
+        ansible.builtin.command:
+          argv:
+          - cat
+          - "~/.ssh/{{ item }}.ppk"
+        loop: "{{ ssh_origin_keypairs_filenames }}"
+        register: ssh_secrets
+      - name: Find SSH public keys in other system
+        delegate_to: "{{ ssh_keypairs_origin_host }}"
+        ansible.builtin.command:
+          argv:
+          - cat
+          - "~/.ssh/{{ item }}.pub"
+        loop: "{{ ssh_origin_keypairs_filenames }}"
+        register: ssh_nonsecrets
+      - name: Create private SSH keys
+        ansible.builtin.copy:
+          content: "{{ item }}"
+          dest: "{{ ansible_facts['user_dir'] }}/.ssh/{{ ssh_origin_keypairs_filenames[idx] }}.ppk"
+          force: yes
+          backup: yes
+          mode: "0600"
+          state: present
+        loop: "{{ ssh_secrets.results }}"
+        loop_control:
+          index_var: idx
+        register: created_ssh_private_keys
+      - name: Create public SSH keys
+        ansible.builtin.copy:
+          content: "{{ item }}"
+          dest: "{{ ansible_facts['user_dir'] }}/.ssh/{{ ssh_origin_keypairs_filenames[idx] }}.pub"
+          force: yes
+          backup: yes
+          mode: "0644"
+          state: present
+        loop: "{{ ssh_nonsecrets.results }}"
+        loop_control:
+          index_var: idx
+        register: created_ssh_public_keys
   - name: Acquire SSH key-pairs
     when: files_mode
     block:
-    - name: Transfer private SSH keys
-      ansible.builtin.copy:
-        src: files/all/ssh/id_ed25519_git.ppk # @TODO change path if and when moved into lockdown role task file and create corresponding file in lockdown role files dir
-        dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.ppk"
-        force: yes
-        backup: yes
-        mode: "0600"
-        state: present
-      register: created_ssh_private_key
-    - name: Transfer public SSH keys
-      ansible.builtin.copy:
-        src: files/all/ssh/id_ed25519_git.pub # @TODO change path if and when moved into lockdown role task file and create corresponding file in lockdown role files dir
-        dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.pub"
-        force: yes
-        backup: yes
-        mode: "0644"
-        state: present
-      register: created_ssh_public_key
+      - name: Transfer private SSH keys
+        ansible.builtin.copy:
+          src: ssh/{{ item }}.ppk
+          dest: "{{ ansible_facts['user_dir'] }}/.ssh/{{ item }}.ppk"
+          force: yes
+          backup: yes
+          mode: "0600"
+          state: present
+        loop: "{{ ssh_origin_keypairs_filenames }}"
+        loop_control:
+          index_var: idx
+        register: created_ssh_private_keys
+      - name: Transfer public SSH keys
+        ansible.builtin.copy:
+          src: ssh/{{ item }}.pub
+          dest: "{{ ansible_facts['user_dir'] }}/.ssh/{{ item }}.pub"
+          force: yes
+          backup: yes
+          mode: "0644"
+          state: present
+        loop: "{{ ssh_origin_keypairs_filenames }}"
+        loop_control:
+          index_var: idx
+        register: created_ssh_public_keys
   - name: Configure acquired, specified SSH public key as git signing key
-    when: ssh_preferred_signing > -1 and not files_mode
+    when: preferred_signing_key > -1
     community.general.git_config:
       name: user.signingkey
       scope: global
       state: present
-      value: "{{ created_ssh_public_keys.results[ssh_preferred_signing] }}" # @TODO this variable needs declaration/definition
+      value: "{{ created_ssh_public_keys.results[preferred_signing_key] }}"
+    register: selected_signing_key
   - name: Configure acquired, random SSH public key as git signing key
-    when: ssh_preferred_signing <= -1 and not files_mode
+    when: preferred_signing_key <= -1
     community.general.git_config:
       name: user.signingkey
       scope: global
       state: present
-      value: "{{ created_ssh_public_keys.results | random  }}" # @TODO this variable needs declaration/definition
-    register: randomized_ssh_pubkey_preference
-  - name: Configure transferred SSH public key as git signing key
-    when: ssh_preferred_signing <= -1 and files_mode
-    community.general.git_config:
-      name: user.signingkey
-      scope: global
-      state: present
-      value: "{{ created_ssh_public_key.dest }}"
+      value: "{{ created_ssh_public_keys.results | random  }}"
+    register: selected_signing_key