tonk.yaml

---
- import_playbook: setup_tpm.yml
  tags: always

- hosts: all
  gather_facts: true
  become: true
  tasks:
    - name: grab needed passwords from tpm
      set_fact:
        backup_passwd: "{{ lookup('tpmstore',
                                  tpm_url,
                                  'root@backup1.example.net',
                                  tpm_public_key,
                                  tpm_private_key,
                                  tpm_certificate,
                                  tpm_certificate_key) }}"
      tags: always

    - name: show it
      debug:
        msg: "backup: {{ backup_passwd }}"

    - name: Check if backup rsync keys present
      tags: backup, backup_keys
      vars:
        ansible_become_method: su
        ansible_su_pass: "{{ backup_passwd }}"
      delegate_to: backup1.example.net
      command: "ls -l /backup/keys/{{ ansible_facts['hostname'] }}"
      register: backup_keys