Add a linux gpg role.

ansible/roles/gpg/tasks/common.yaml

@@ -0,0 +1,14 @@
+- import_tasks: tasks/freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/linux.yaml
+  when: 'os_flavor == "linux"'
+
+- include_tasks:
+    file: tasks/peruser.yaml
+    apply:
+      become: yes
+      become_user: "{{ initialize_user }}"
+  loop: "{{ users | dict2items | community.general.json_query('[?value.initialize==`true`].key') }}"
+  loop_control:
+    loop_var: initialize_user

ansible/roles/gpg/tasks/freebsd.yaml

@@ -0,0 +1,41 @@
+- name: Install packages
+  package:
+    name:
+      - gnupg
+      - pcsc-tools
+      - ccid
+      #      - linux_libusb
+      - pinentry
+      - pinentry-qt5    state: present
+
+- name: Create directories
+  file:
+    name: "{{ item }}"
+    state: directory
+    mode: 0755
+    owner: root
+    group: wheel
+  loop:
+    - /usr/local/etc/devd
+
+- name: Install service configuration
+  copy:
+    src: "files/intel_{{ item }}_rc.conf"
+    dest: "/etc/rc.conf.d/{{ item }}"
+    mode: 0644
+    owner: root
+    group: wheel
+  loop:
+    - pcscd
+
+- name: Install devd Configuration
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: wheel
+  notify: restart devd
+  loop:
+    - src: pcscd.conf
+      dest: /usr/local/etc/devd/pcscd.conf

ansible/roles/gpg/tasks/linux.yaml

@@ -0,0 +1,29 @@
+- name: Install packages
+  package:
+    name:
+      - gnupg
+      - pcsc-tools
+      - ccid
+      - libusb-compat
+      - pinentry
+    state: present
+
+- name: Enable pcscd
+  systemd:
+    name: "{{ item }}"
+    state: started
+    enabled: yes
+    daemon_reload: yes
+  loop:
+    - pcscd.socket
+
+- name: Install scripts
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0755
+    owner: "{{ build_user.name }}"
+    group: "{{ build_user.group }}"
+  loop:
+    - src: yubikey_relearn_keys
+      dest: /usr/local/bin/yubikey_relearn_keys

ansible/roles/gpg/tasks/main.yaml

@@ -0,0 +1 @@
+- import_tasks: tasks/common.yaml

ansible/roles/gpg/tasks/peruser.yaml

@@ -0,0 +1,29 @@
+- include_role:
+    name: per_user
+
+# - name: Create directories
+#   file:
+#     name: "{{ account_homedir.stdout }}/{{ item }}"
+#     state: directory
+#     mode: 0700
+#     owner: "{{ account_name.stdout }}"
+#     group: "{{ group_name.stdout }}"
+#   loop:
+#     - ".config/foo"
+
+# - name: Copy files
+#   copy:
+#     src: "files/{{ item.src }}"
+#     dest: "{{ account_homedir.stdout }}/{{ item.dest }}"
+#     mode: 0600
+#     owner: "{{ account_name.stdout }}"
+#     group: "{{ group_name.stdout }}"
+#   loop:
+#     - src: foo.conf
+#       dest: .config/foo/foo.conf
+
+- import_tasks: tasks/peruser_freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/peruser_linux.yaml
+  when: 'os_flavor == "linux"'

ansible/roles/gpg/tasks/peruser_linux.yaml

@@ -0,0 +1,45 @@
+- name: Enable the gpg user agent
+  systemd:
+    name: "{{ item }}"
+    state: started
+    enabled: yes
+    daemon_reload: yes
+    scope: user
+  loop:
+    - gpg-agent.socket
+    - gpg-agent-ssh.socket
+
+- name: Create gpg config directory
+  file:
+    name: "{{ account_homedir.stdout }}/.gnupg"
+    state: directory
+    mode: 0700
+    owner: "{{ account_name.stdout }}"
+    group: "{{ group_name.stdout }}"
+
+- name: Configure gpg
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ account_homedir.stdout }}/{{ item.dest }}"
+    mode: 0600
+    owner: "{{ account_name.stdout }}"
+    group: "{{ group_name.stdout }}"
+  loop:
+    - src: gpg.conf
+      dest: .gnupg/gpg.conf
+    - src: gpg-agent.conf
+      dest: .gnupg/gpg-agent.conf
+    - src: scdaemon.conf
+      dest: .gnupg/scdaemon.conf
+
+- name: Check trusted gpg keys
+  command: gpg --list-public-keys --keyid-format LONG
+  register: gpgkeys
+  changed_when: false
+  check_mode: no
+
+- name: Import public key for yubikey
+  command: gpg --import
+  when: '"cv25519/B0B50C7FDDE009E5" not in gpgkeys.stdout'
+  args:
+    stdin: "{{ lookup('file', 'gpg.asc') }}"