From ac7e50c5e7707c8465886e197555adf78ecd45c1 Mon Sep 17 00:00:00 2001
From: Seth Etter <mail@sethetter.com>
Date: Fri, 19 Jun 2026 10:35:22 -0500
Subject: [PATCH] devserver/ansible: install infisical on the host

Will be using this for remote secrets management!
---
 .../roles/infisical/defaults/main.yaml        |  5 +++
 .../ansible/roles/infisical/tasks/main.yaml   | 35 +++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 devserver/ansible/roles/infisical/defaults/main.yaml
 create mode 100644 devserver/ansible/roles/infisical/tasks/main.yaml

diff --git a/devserver/ansible/roles/infisical/defaults/main.yaml b/devserver/ansible/roles/infisical/defaults/main.yaml
new file mode 100644
index 0000000..e8a7269
--- /dev/null
+++ b/devserver/ansible/roles/infisical/defaults/main.yaml
@@ -0,0 +1,5 @@
+---
+# infisical CLI role — configurable defaults.
+infisical_cli_version: "latest"
+infisical_setup_script_url: "https://artifacts-cli.infisical.com/setup.deb.sh"
+infisical_apt_source_path: "/etc/apt/sources.list.d/infisical.list"
diff --git a/devserver/ansible/roles/infisical/tasks/main.yaml b/devserver/ansible/roles/infisical/tasks/main.yaml
new file mode 100644
index 0000000..7a362b2
--- /dev/null
+++ b/devserver/ansible/roles/infisical/tasks/main.yaml
@@ -0,0 +1,35 @@
+---
+# -------------------------------------------------------------------
+# Installs and makes sure the infisical cli is on the latest version
+# -------------------------------------------------------------------
+
+# Register the apt repository
+- name: Check if infisical apt source is already registered
+  ansible.builtin.stat:
+    path: "{{ infisical_apt_source_path }}"
+  register: infisical_apt_source
+
+- name: Run infisical setup script to register apt repo + GPG key
+  become: true
+  ansible.builtin.shell: curl -1sLf '{{ infisical_setup_script_url }}' | bash
+  when: not infisical_apt_source.stat.exists
+  changed_when: true
+
+- name: Install infisical CLI (latest)
+  become: true
+  ansible.builtin.apt:
+    name: infisical
+    state: latest
+    update_cache: true
+  when: infisical_cli_version == "latest"
+
+# Verify
+- name: Read installed infisical version
+  ansible.builtin.command: infisical --version
+  register: infisical_installed_version
+  changed_when: false
+  check_mode: false
+
+- name: Show installed infisical version
+  ansible.builtin.debug:
+    msg: "infisical CLI installed: {{ infisical_installed_version.stdout | trim }}"
-- 
2.51.2