adding firstrun playbook

group_vars/all/main.yml

@@ -2,21 +2,16 @@
 # Vars for every VPS in the fleet. Keep this file plaintext and readable
 # in diffs - actual secret values live in group_vars/all/vault.yml.
 
-timezone: "America/Chicago"
 
-# The non-root user created/used for all future Ansible runs
-deploy_user: ansible
-deploy_user_shell: /bin/bash
 
-# SSH public keys granted access to deploy_user on every host
-deploy_user_ssh_keys:
-  - "{{ ssh_key_ansible }}"
+
+
 
 # Hardening toggles (see roles/security)
 ssh_permit_root_login: "no"
 ssh_password_authentication: "no"
 ssh_port: 25456
-ansible_port: 25456
+: 25456
 
 ufw_allowed_tcp_ports:
   - "{{ ssh_port }}"

group_vars/firstrun/main.yml

@@ -0,0 +1,16 @@
+---
+# vars that are only used for the first setup. after this the defaults change to not use root.
+# this is to setup the ansible user, basic tools and security measures. 
+
+# setup needed connection information
+ansible_port: 22
+
+# The non-root user created/used for all future Ansible runs
+deploy_user: ansible
+deploy_user_shell: /bin/bash
+
+# SSH public keys granted access to deploy_user on every host
+deploy_user_ssh_keys:
+  - "{{ ssh_key_ansible }}"
+
+timezone: "America/Chicago"