I've.. gone a little crazy with it. I have my own Ansible Collection consisting of a common role, a Certificate Authority role, and a pair of SSH Host/Client ro

I've.. gone a little crazy with it. I have my own Ansible Collection consisting of a common role, a Certificate Authority role, and a pair of SSH Host/Client roles, which together provision and lockdown the CA server, configure the users, principles, and certificates on my machines, and setup a system for future (renewed or revoked) certificate propagation. It was one of my first major ansible projects, and I learned a heck of a lot about best-practice putting it all together. The CA server will renew keys automatically, but can only be accessed with a dedicated key that's left in the playbook directory.