From 7228dc6e11536630d48d3c8a7ba97d325d9e314a Mon Sep 17 00:00:00 2001 From: Hermes Agent service account Date: Fri, 29 May 2026 22:51:10 -0500 Subject: [PATCH] feat(semaphore): wed-ssh as the canonical Semaphore SSH key Adds wed-ssh (the universal automation account pre-baked in every VM template) to the declared key set and switches the production inventory to use it for both ssh_key and become_key. Retains jarvis-ssh for cases that specifically need admin-level access. This aligns Semaphore-driven jobs with the established homelab convention: wed runs the playbooks, jarvis is the higher-privilege admin account provisioned by linux-baseline. Operator (Ryan) cleaned out the previous templates + inventory in Semaphore before this commit so the configure step re-creates them wired to wed-ssh on its next run. --- ansible/group_vars/all/semaphore.yml | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/ansible/group_vars/all/semaphore.yml b/ansible/group_vars/all/semaphore.yml index a6b9f2c..13210ea 100644 --- a/ansible/group_vars/all/semaphore.yml +++ b/ansible/group_vars/all/semaphore.yml @@ -60,7 +60,17 @@ semaphore_config: ssh_login: git ssh_private_key: "{{ vault_gitea_deploy_key }}" - # SSH key Semaphore uses to reach the fleet as jarvis. + # SSH key for the universal automation account 'wed' — pre-baked in + # every mk-labs VM template. This is the canonical user Semaphore + # uses to reach the fleet. + - name: wed-ssh + type: ssh + ssh_login: wed + ssh_private_key: "{{ vault_wed_ssh_private_key }}" + + # SSH key Semaphore can use to reach the fleet as jarvis (admin + # account provisioned by linux-baseline). Retained for jobs that + # specifically need jarvis-level access; the default is wed-ssh. - name: jarvis-ssh type: ssh ssh_login: jarvis @@ -77,8 +87,10 @@ semaphore_config: type: file inventory_file: ansible/inventory.yml repository: homelab - ssh_key: jarvis-ssh - become_key: jarvis-ssh + # wed is the universal automation account pre-baked in every VM + # template. Semaphore uses it for fleet-wide jobs. + ssh_key: wed-ssh + become_key: wed-ssh environments: - name: default