bootstrap.yml

---
- name: prepare temporary group
  hosts: all
  gather_facts: no
  connection: local

  tasks:
  - name: create temporary group for the target host
    add_host:
      hostname: "{{ target_host }}"
      groupname: new_host

# Needs to be performed here, so the secrets are available for the new group
- import_playbook: "load-secrets.yml"

- name: bootstrap remote server
  hosts: new_host
  connection: ssh
  remote_user: "{{ target_user }}"
  become: yes
  become_user: root
  gather_facts: no
  vars:
    # Fortunately, '/root' always exists.  This variable is used to prevent
    # typing errors.
    bootstrap_script: "/root/run-once"

  tasks:
  # There's an overlap here with run-once script.  I (sa2ajj) could not think
  # of any "nicer" way though.
  - name: install ansible
    raw: "pkg install --yes python3 {{ pkg_ansible_version }}"

  - name: prepare bootstrap script
    template:
      src: "templates/run-once"
      dest: "{{ bootstrap_script }}"
      mode: "0700"

  - name: execute bootstrap script
    command: "{{ bootstrap_script }}"

  - name: remove bootstrap script
    file:
      path: "{{ bootstrap_script }}"
      state: absent