provision, add section for tunnel.

tasks/general/acct_mgmt/provision_config.yml

@@ -164,7 +164,18 @@
       ;               Example: jim, bob, jeff, anne
       ;               Default: user
       ;
-      ; For pushing MASTER directories to an SFTP server with `send-master`.
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
+- name: General | Account Management | Provisioning Configuration | General | Create | Sync Shortcuts
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Sync Shortcuts'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;         Sync Shortcuts         ;;;;;;;;;;;;;;;;;;;;;
       ;
       ; Imagine the command:
       ;   `rsync -auPhz --delete -e 'ssh -p prod_data_port' ./mydata-MASTER/ \
@@ -193,6 +204,44 @@
     backup: true
     mode: "0644"
 
+- name: General | Account Management | Provisioning Configuration | General | Create | Tunnel
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Tunnel'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Tunnel ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+      ;
+      ; Create a runit script which maintains an SSH tunnel to a remote server.
+      ;
+      ;        ssh -v -H -R tunnel_remote_port:localhost:tunnel_local_port \
+      ;             [-p tunnel_ssh_port] tunnel_remote_host
+      ;
+      ; tunnel_local_port (default=8080)
+      ;   Local HTTP port which need forwarded to a remote server.
+      ;     Example: http://localhost:8080
+      ;
+      ; tunnel_remote_host (default=false)
+      ;   Remote server including username (such as user@example.com) which will
+      ;   serve the port. Server should preferably have a reverse proxy in order
+      ;   to encrypt the traffic, otherwise the local server should use HTTPS.
+      ;
+      ; tunnel_remote_port (default=8080)
+      ;   Port which should host the service on the remote server. This is what
+      ;   will get typed into web browsers or used by the reverse proxy. Should
+      ;   be > 1024. Also, /etc/ssh/sshd_config will need AllowTcpForwarding and
+      ;   GatewayPorts set to yes, then sshd will need to be reloaded.
+      ;     Example: http://example.com:8080
+      ;
+      ; tunnel_ssh_port (default=22)
+      ;   Port which the remote server exposes ssh.
+      ;     Example: ssh -p 2222 user@example.com
+      ;
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
 - name: General | Account Management | Provisioning Configuration | General | Load
   ansible.builtin.set_fact:
     provision:  "{{ lookup('ini', 'enable     file={{gen_file}} default=false') | bool }}"
@@ -217,6 +266,10 @@
     prod_data_port: "{{ lookup('ini', 'prod_data_port   file={{gen_file}} default=22') | int }}"
     prod_data_user: "{{ lookup('ini', 'prod_data_user   file={{gen_file}} default=user') }}"
     prod_data_dir:  "{{ lookup('ini', 'prod_data_dir    file={{gen_file}} default=/srv/sftp') }}"
+    tunnel_local_port:  "{{ lookup('ini', 'tunnel_local_port  file={{gen_file}} default=8080' ) | int }}"
+    tunnel_remote_host: "{{ lookup('ini', 'tunnel_remote_host file={{gen_file}} default=false')       }}"
+    tunnel_remote_port: "{{ lookup('ini', 'tunnel_remote_port file={{gen_file}} default=8080' ) | int }}"
+    tunnel_ssh_port:    "{{ lookup('ini', 'tunnel_ssh_port    file={{gen_file}} default=22'   ) | int }}"
 
 - name: General | Account Management | Provisioning Configuration | General | Boolean Check | Swap Block
   ansible.builtin.set_fact:
@@ -249,6 +302,10 @@
     - { 'prod_data_port': "{{ prod_data_port }}" }
     - { 'prod_data_user': "{{ prod_data_user }}" }
     - { 'prod_data_dir': "{{ prod_data_dir }}" }
+    - { 'tunnel_local_port': "{{ tunnel_local_port }}" }
+    - { 'tunnel_remote_host': "{{ tunnel_remote_host }}" }
+    - { 'tunnel_remote_port': "{{ tunnel_remote_port }}" }
+    - { 'tunnel_ssh_port': "{{ tunnel_ssh_port }}" }
 
 
 ## Workstation ##