用于设置 Initramfs Dropbear 通过 SSH 进行 LUKS 解密的 Ansible playbook

---
- name: Configure remote LUKS unlocking with Dropbear
  hosts: all
  become: true
  vars:
    dropbear_auth_keys_path: /etc/dropbear/initramfs/authorized_keys

  tasks:
    - name: Install required packages
      apt:
        name:
          - cryptsetup
          - dropbear
          - dropbear-initramfs
          - dropbear-bin
        state: present
        update_cache: yes
      register: apt_install_result

    - name: Ensure the Dropbear initramfs directory exists
      file:
        path: /etc/dropbear/initramfs
        state: directory
        mode: '0755'

    - name: Copy SSH public key to Dropbear authorized_keys
      copy:
        src: luks-dropbear-authorized_keys.pub
        dest: "{{ dropbear_auth_keys_path }}"
        mode: '0600'
      register: auth_keys_result

    - name: Reconfigure Dropbear initramfs
      shell: dpkg-reconfigure dropbear-initramfs
      when: apt_install_result.changed or auth_keys_result.changed

    - name: Update initramfs
      shell: update-initramfs -u
      when: apt_install_result.changed or auth_keys_result.changed