From 792dca976dc7a1347d4aa7649e3f43d51bbb26d7 Mon Sep 17 00:00:00 2001
From: michael <operations@dangerousthings.com>
Date: Mon, 27 Apr 2026 08:34:26 -0700
Subject: [PATCH] ansible: scaffold dangerousthings.authforge role skeleton

Adds meta/main.yml (Galaxy metadata for Ubuntu 22.04/24.04 under the
Apache-2.0 license), defaults/main.yml covering the policy/storage/
firstrun/pending knobs the tasks layer will consume, and a single
restart-daemon handler. Tasks and template land in the next commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ansible-role/defaults/main.yml | 31 +++++++++++++++++++++++++++++++
 ansible-role/handlers/main.yml |  5 +++++
 ansible-role/meta/main.yml     | 30 ++++++++++++++++++++++++++++++
 3 files changed, 66 insertions(+)
 create mode 100644 ansible-role/defaults/main.yml
 create mode 100644 ansible-role/handlers/main.yml
 create mode 100644 ansible-role/meta/main.yml

diff --git a/ansible-role/defaults/main.yml b/ansible-role/defaults/main.yml
new file mode 100644
index 0000000..a2a7004
--- /dev/null
+++ b/ansible-role/defaults/main.yml
@@ -0,0 +1,31 @@
+---
+# Whether to additionally pull the GUI package. Headless fleets should leave
+# this off; desktop fleets that want the AuthForge settings panel can flip it.
+authforge_install_gui: false
+
+# PPA to install from. Override if you mirror packages internally.
+authforge_ppa: "ppa:dangerousthings/authforge"
+
+# Map of stack name -> { mode, methods }. mode is one of
+# "disabled" | "optional" | "required". methods is a list e.g. ["fido2", "totp"].
+# Default is empty so the role can be applied for "install only" runs.
+authforge_stacks: {}
+
+# Credential storage backend. "per-user" stores credentials under each user's
+# home directory; "central" stores them at authforge_storage_central_path so
+# they survive home-directory wipes (e.g. AD-managed boxes).
+authforge_storage_backend: "per-user"
+authforge_storage_central_path: ""
+
+# First-login enforcement. Users who exist in the pending list will be required
+# to enroll one of these methods on their next interactive login.
+authforge_firstrun_methods:
+  - "fido2"
+
+# How long after the pending flag is set before the user is locked out if they
+# have not enrolled. 0 means no deadline (warn forever).
+authforge_firstrun_deadline_hours: 0
+
+# Users to mark as pending-enrollment via `authforgectl pending set`.
+# Each entry: { user: "alice", methods: ["fido2"] }.
+authforge_pending_users: []
diff --git a/ansible-role/handlers/main.yml b/ansible-role/handlers/main.yml
new file mode 100644
index 0000000..d121145
--- /dev/null
+++ b/ansible-role/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: restart authforge-daemon
+  ansible.builtin.systemd:
+    name: authforge-daemon
+    state: restarted
diff --git a/ansible-role/meta/main.yml b/ansible-role/meta/main.yml
new file mode 100644
index 0000000..1cdbd6a
--- /dev/null
+++ b/ansible-role/meta/main.yml
@@ -0,0 +1,30 @@
+---
+galaxy_info:
+  role_name: authforge
+  namespace: dangerousthings
+  author: Dangerous Things
+  description: >
+    Install and configure AuthForge (FIDO2 / U2F / TOTP MFA for Ubuntu) on
+    fleet hosts. Adds the project PPA, installs the headless component
+    packages, drops a fleet policy file, and seeds first-login pending
+    enrollment flags.
+  license: Apache-2.0
+  min_ansible_version: "2.14"
+
+  platforms:
+    - name: Ubuntu
+      versions:
+        - jammy
+        - noble
+
+  galaxy_tags:
+    - authforge
+    - mfa
+    - fido2
+    - u2f
+    - totp
+    - pam
+    - security
+    - ubuntu
+
+dependencies: []