Refactor scattered known_hosts to be part of the ssh role

5 files changed, 17 insertions, 14 deletions

diff --git a/roles/dotfiles/tasks/main.yml b/roles/dotfiles/tasks/main.yml
index b36c1e01..51b2e817 100644
--- a/roles/dotfiles/tasks/main.yml
+++ b/roles/dotfiles/tasks/main.yml
@@ -1,11 +1,4 @@
 ---
-- name: "Add sr.ht to known_hosts"
-  ansible.builtin.known_hosts:
-    name: "git.sr.ht"
-    key: "git.sr.ht ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60"
-    path: "{{ ansible_env.HOME }}/.ssh/known_hosts"
-    state: present
-
 - name: "Clone dotfiles git repo"
   ansible.builtin.git:
     repo: "{{ dotfiles_repo_url }}"
diff --git a/roles/password_store/tasks/main.yml b/roles/password_store/tasks/main.yml
index 72df297a..0537b5fe 100644
--- a/roles/password_store/tasks/main.yml
+++ b/roles/password_store/tasks/main.yml
@@ -8,13 +8,6 @@
     name: "{{ password_store_packages }}"
     state: "present"
 
-- name: "Add GitHub to known_hosts"
-  ansible.builtin.known_hosts:
-    name: "github.com"
-    key: "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
-    path: "{{ ansible_env.HOME }}/.ssh/known_hosts"
-    state: present
-
 - name: "Clone password store git repo"
   ansible.builtin.git:
     repo: "{{ password_store_repo_url }}"
diff --git a/roles/ssh/defaults/main.yml b/roles/ssh/defaults/main.yml
index a3f3e329..ac2ff59f 100644
--- a/roles/ssh/defaults/main.yml
+++ b/roles/ssh/defaults/main.yml
@@ -1,2 +1,5 @@
 ---
 ssh_port: 2222
+ssh_known_hosts:
+  - "git.sr.ht ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60"
+  - "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
diff --git a/roles/ssh/meta/argument_specs.yml b/roles/ssh/meta/argument_specs.yml
index 7581a905..a2e1721e 100644
--- a/roles/ssh/meta/argument_specs.yml
+++ b/roles/ssh/meta/argument_specs.yml
@@ -13,3 +13,8 @@ argument_specs:
         required: false
         default: 2222
         description: "The default ssh port configuration (to avoid port 22 pwn/testing)"
+      ssh_known_hosts:
+        type: "list"
+        elements: "str"
+        required: false
+        description: "List of SSH known_hosts entries in 'hostname keytype keydata' format"
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
index 9728e303..76ba7aa5 100644
--- a/roles/ssh/tasks/main.yml
+++ b/roles/ssh/tasks/main.yml
@@ -94,3 +94,12 @@
       AllowUsers {{ username }}
   notify:
     - "Restart ssh"
+
+- name: "Configure known_hosts"
+  ansible.builtin.known_hosts:
+    name: "{{ item.split(' ') | first }}"
+    key: "{{ item }}"
+    path: "{{ ansible_env.HOME }}/.ssh/known_hosts"
+    state: present
+  loop: "{{ ssh_known_hosts }}"
+  when: ssh_known_hosts is defined and ssh_known_hosts | length > 0