diff options
| author | Ahmed Abdelhalim <[email protected]> | 2026-07-26 03:48:12 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2026-07-26 03:48:12 +0200 |
| commit | 19ae38db9c3ce3e1dac4ca8ce454c59a58619100 (patch) | |
| tree | 2a48fae1674ddd431689f799e3fbce581366ca3e | |
| parent | f4732a0c295a454119d3c2ac01c96f4cc2fa6ab4 (diff) | |
Reconcile pve-lxc-ssh config every run, not just on first install
pve_lxc_ssh_check.rc != 0 gated the entire block, so once openssh was
installed, sshd_config pushes, host key deploys, and service enable/
restart never ran again on reconverge — template changes (e.g. sshd
hardening) silently never reached already-provisioned containers.
Narrow the conditional to just the package-install step; everything
else already idempotent, runs unconditionally now.
Co-Authored-By: Claude.ai
| -rw-r--r-- | roles/pve-lxc-ssh/tasks/main.yml | 33 |
1 files changed, 16 insertions, 17 deletions
diff --git a/roles/pve-lxc-ssh/tasks/main.yml b/roles/pve-lxc-ssh/tasks/main.yml index bf29ad51..8a1dd095 100644 --- a/roles/pve-lxc-ssh/tasks/main.yml +++ b/roles/pve-lxc-ssh/tasks/main.yml @@ -16,26 +16,28 @@ tags: - "molecule-notest" -- name: "Install openssh and configure openssh" +- name: "Install openssh" become: true tags: - "molecule-notest" when: pve_lxc_ssh_check.rc != 0 - block: - - name: "Install openssh" - ansible.builtin.command: - cmd: > - pct exec {{ pve_lxc_id }} -- sh -c ' - . /etc/os-release; - case $ID in - alpine) apk add --no-cache openssh ;; - debian|ubuntu) apt-get install -y openssh-server ;; - *) echo "Unsupported distro: $ID" && exit 1 ;; - esac;' - changed_when: true + ansible.builtin.command: + cmd: > + pct exec {{ pve_lxc_id }} -- sh -c ' + . /etc/os-release; + case $ID in + alpine) apk add --no-cache openssh ;; + debian|ubuntu) apt-get install -y openssh-server ;; + *) echo "Unsupported distro: $ID" && exit 1 ;; + esac;' + changed_when: true +- name: "Configure openssh" + become: true + tags: + - "molecule-notest" + block: - name: "Deploy ssh host private key" - become: true no_log: true ansible.builtin.command: cmd: > @@ -45,7 +47,6 @@ changed_when: true - name: "Deploy ssh host public key" - become: true ansible.builtin.command: cmd: > pct exec {{ pve_lxc_id }} -- sh -c @@ -60,7 +61,6 @@ mode: "0600" - name: "Push sshd_config into container" - become: true ansible.builtin.command: cmd: pct push {{ pve_lxc_id }} /tmp/sshd_config_{{ pve_lxc_id }} /etc/ssh/sshd_config --perms 0640 changed_when: true @@ -71,7 +71,6 @@ state: absent - name: "Enable and start sshd" - become: true ansible.builtin.command: cmd: > pct exec {{ pve_lxc_id }} -- sh -c |