fix(sshd): move login banner to zsh .zprofile

sshd Banner fires on every connection (scp, sftp, non-interactive), the wrong layer for a welcome banner. Move to .zprofile, interactive login shells only.

roles/zsh/tasks/user-setup.yml

@@ -7,6 +7,14 @@
     group: "{{ zsh_user }}"
     mode: "0600"
 
+- name: Setup .zprofile (login banner)
+  ansible.builtin.template:
+    src: zprofile.j2
+    dest: "{{ zsh_home }}/.zprofile"
+    owner: "{{ zsh_user }}"
+    group: "{{ zsh_user }}"
+    mode: "0600"
+
 - name: Setup zsh base config
   ansible.builtin.template:
     src: main.zshrc.j2

roles/zsh/templates/zprofile.j2

@@ -0,0 +1,76 @@
+# {{ ansible_managed }}
+# Login banner - shown once per interactive login shell (before .zshrc / prompt)
+
+if [[ -o interactive ]]; then
+  cat <<'ANSIBLE_BANNER_END'
+{% if ansible_host == 'andromeda' %}
+*******************************************
+ Beep beep-wooOOoo! Brrrp! Zzt zzt-whirl!
+*******************************************
+        ⣠⣴⣾⣿⣿⣿⣿⣷⣦⣄
+      ⢠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⡄
+     ⢀⣿⣿⣿⣿⡿⠛⢿⡿⠛⢻⣿⣿⣿⣿⡀  <IMPERIAL SECURITY
+     ⢸⣿⣿⣿⣿⡇ ⢸⣷⣶⣾⣿⣿⣿⣿⡇   IDENTIFICATION DROID
+     ⠈⠉⠉⠉⠉⠁ ⠈⠉⠉⠉⠉⠉⠉⠉⠁
+   ⢀⣤⣀⣾⣿⣿⣿⠟⠛⠛⠛⠛⠻⣿⣿⣿⣷⣀⣤⡀
+   ⢸⣿⣿⣿⣿⣿⣿⣤⣤⣤⣤⣤⣤⣿⣿⣿⣿⣿⣿⡇
+   ⢸⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⣿⣿⣿⣿⣿⣿⣿⣿⡇
+   ⢸⣿⣿⣿⣿⣿⣿⣿⣿  ⣿⣿⣿⣿⣿⣿⣿⣿⡇
+   ⢸⣿⡟⢿⣿⣿⣿⣿⣿  ⣿⣿⣿⣿⣿⡿⢻⣿⡇
+   ⢸⣿⡇⠈⠙⠛⢛⣿⣿⣤⣤⣿⣿⡛⠛⠋⠁⢸⣿⡇
+  ⣤⣼⣿⣧⣤⡀ ⠙⠛⠛⠛⠛⠛⠛⠋ ⢀⣤⣼⣿⣧⣤
+  ⠛⠛⠛⠛⠛⠁          ⠈⠛⠛⠛⠛⠛
+{% elif ansible_host == 'omega' %}
+*******************************************
+     GALACTIC EMPIRE SECURE TERMINAL
+*******************************************
+         ⣀⣤⣴⣶⣾⣿⣿⣿⣿⣷⡶⠦
+      ⢀⣴⣾⣿⣿⠿⠿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣧⣤⡄
+     ⣰⣿⣿⣿⠋    ⠈⢻⣿⣿⣿⣿⣿⣿⡟⠛⠛⠃
+    ⣼⣿⣿⣿⡇       ⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧
+   ⢰⣿⣿⣿⣿⣧⡀     ⣠⣿⣿⣿⣿⣿⣿⠿⠟⠛⠁
+   ⣾⣿⣿⣿⣿⣿⣿⣶⣤⣤⣴⣾⣿⣿⣿⣿⣿⣿⣷⣶⣶⣶⣶⣶⣶⣶
+   ⣉⠉⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠉⣉
+   ⢿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣶⣶⣶⣶⣶⣶⣾⣿⣿⣿⣿⣿⣿⣿⠿⠿
+   ⠸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠛⠛⠋⠉
+    ⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⣤⣤⣤⣤⡄
+     ⠹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏
+      ⠈⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣤⡄
+         ⠉⠛⠻⠿⢿⣿⣿⣿⣿⠟⠉⠉⠉⠉
+
+You have reached a terminal of the Galactic
+Empire's secure network. Unauthorized access
+will result in tracking and possible Force
+action.
+{% elif ansible_host == 'pinwheel' %}
+*******************************************
+       May the shell be with you
+*******************************************
+ ⢀⣠⣄⣀⣀⣀               ⣀⣤⣴⣶⡾⠿⠿⠿⠿⢷⣶⣦⣤⣀⡀
+⢰⣿⡟⠛⠛⠛⠻⠿⠿⢿⣶⣶⣦⣤⣤⣀⣀⡀⣀⣴⣾⡿⠟⠋⠉        ⠉⠙⠻⢿⣷⣦⣀         ⢀⣀⣀⣀⣀⣀⣀⣀⡀
+ ⠻⣿⣦⡀ ⠉⠓⠶⢦⣄⣀⠉⠉⠛⠛⠻⠿⠟⠋⠁   ⣤⡀  ⢠   ⣠    ⠈⠙⠻⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠟⠛⠛⢻⣿
+  ⠈⠻⣿⣦    ⠈⠙⠻⢷⣶⣤⡀    ⢀⣀⡀ ⠙⢷⡀⠸⡇ ⣰⠇ ⢀⣀⣀      ⣀⣠⣤⣤⣶⡶⠶⠶⠒⠂  ⣠⣾⠟
+    ⠈⢿⣷⡀      ⠈⢻⣿⡄⣠⣴⣿⣯⣭⣽⣷⣆ ⠁    ⢠⣾⣿⣿⣿⣿⣦⡀ ⣠⣾⠟⠋⠁       ⣠⣾⡟⠁
+     ⠈⢻⣷⣄       ⣿⡗⢻⣿⣧⣽⣿⣿⣿⣧  ⣀⣀ ⢠⣿⣧⣼⣿⣿⣿⣿⠗⠰⣿⠃        ⣠⣾⡿⠋
+       ⠙⢿⣶⣄⡀    ⠸⠃⠈⠻⣿⣿⣿⣿⣿⡿⠃⠾⣥⡬⠗⠸⣿⣿⣿⣿⣿⡿⠛ ⢀⡟      ⣀⣠⣾⡿⠋
+         ⠉⠛⠿⣷⣶⣤⣤⣄⣰⣄  ⠉⠉⠉⠁ ⢀⣀⣠⣄⣀⡀ ⠉⠉⠉  ⢀⣠⣾⣥⣤⣤⣤⣶⣶⡿⠿⠛⠉
+             ⠈⠉⢻⣿⠛⢿⣷⣦⣤⣴⣶⣶⣦⣤⣤⣤⣤⣬⣥⡴⠶⠾⠿⠿⠿⠿⠛⢛⣿⣿⣿⣯⡉⠁
+               ⠈⣿⣧⡀⠈⠉ ⠈⠁⣾⠛⠉⠉          ⣀⣴⣿⠟⠉⣹⣿⣇
+               ⢀⣸⣿⣿⣦⣀   ⢻⡀       ⢀⣠⣤⣶⣿⠋⣿⠛⠃ ⣈⣿⣿
+               ⣿⡿⢿⡀⠈⢹⡿⠶⣶⣼⡇ ⢀⣀⣀⣤⣴⣾⠟⠋⣡⣿⡟ ⢻⣶⠶⣿⣿⠛⢯
+              ⠘⣿⣷⡈⢿⣦⣸⠇⢀⡿⠿⠿⡿⠿⠿⣿⠛⠋⠁ ⣴⠟⣿⣧⡀⠈⢁⣰⣿⠏ ⠏⡆
+               ⢸⣿⢻⣦⣈⣽⣀⣾⠃ ⢸⡇ ⢸⡇ ⢀⣠⡾⠋⢰⣿⣿⣿⣿⡿⠟⠋
+               ⠘⠿⢿⣿⣿⡟⠛⠃  ⣾  ⢸⡇⠐⠿⠋  ⣿⢻⣿⣿
+                  ⢸⣿⠁⢀⡴⠋ ⣿  ⢸⠇     ⠁⢸⣿⣿
+                 ⢀⣿⡿⠟⠋   ⣿  ⣸       ⢸⣿⣿
+                 ⢸⣿⣁⣀    ⣿⡀ ⣿      ⢀⣈⣿⣿
+                 ⠘⠛⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠟⠛⠋
+{% else %}
+JEDI LOST - UNKNOWN STAR SYSTEM
+{% endif %}
+
+{% if ansible_hostname is defined %}
+{{ group_names | first }}: {{ ansible_hostname }}
+{% endif %}
+ANSIBLE_BANNER_END
+fi