bastion discussion

[alvarocurt]

This is not 100% project-related, but reading the code of the role 'bastion' in the pre.yml playbook, I had a small concern for the bastion/proxy group:
While it is indeed an ansible inventory group, it is used for the generation of the sshconfig files:

• The sshconfig tasks is in a bastion's play, but with delegate_to: localhost. If there are multiple bastions, this task is done multiple times (with same option due to idempotency, yes, but its innecessary). Maybe a run_once option would be helpful, or a condition where the task only runs for bastion[0].
• Providing multiple bastions may make sense if sshconfig is configured with some kind of roundrobin or similar. E.g.

Host n1a1
  Hostname 10.2.50.86
  User ubuntu
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  ForwardAgent yes
  ProxyCommand bash -c '
    for proxy in bastion1 bastion2 bastion3; do
      nc -w 3 "$proxy" 22 </dev/null && exec ssh -W %h:%p "$proxy"
    done
    exit 1
  '

• It is obvious that bastion is intended to be a single-user group, but no documentation says otherwise.