Change pve-lxc-ssh implementation to only inject pre-generated keys

Co-Authored-By: Claude.ai

8 files changed, 41 insertions, 3 deletions

diff --git a/configure.yml b/configure.yml
index 647c0204..e707dfab 100644
--- a/configure.yml
+++ b/configure.yml
@@ -152,6 +152,8 @@
       vars:
         pve_lxc_id: "{{ hostvars[service_host].pve_lxc_id }}"
         pve_lxc_ssh_port: "{{ hostvars[service_host].pve_lxc_ssh_port }}"
+        pve_lxc_ssh_private_key: "{{ hostvars[service_host].pve_lxc_ssh_private_key }}"
+        pve_lxc_ssh_public_key: "{{ hostvars[service_host].pve_lxc_ssh_public_key }}"
       loop: "{{ groups['containers'] }}"
       loop_control:
         loop_var: "service_host"
diff --git a/group_vars/all.yml b/group_vars/all.yml
index d5a8a535..f39487b7 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
diff --git a/host_vars/git.home.arpa.yml b/host_vars/git.home.arpa.yml
index 5dc2b143..ef0d2d6c 100644
--- a/host_vars/git.home.arpa.yml
+++ b/host_vars/git.home.arpa.yml
diff --git a/host_vars/git.home.arpa.yml.example b/host_vars/git.home.arpa.yml.example
index fe14f69d..cd3a464c 100644
--- a/host_vars/git.home.arpa.yml.example
+++ b/host_vars/git.home.arpa.yml.example
@@ -13,6 +13,15 @@ pve_lxc_ip: "{{ network_ipv4_address }}/24"
 pve_lxc_gateway: "{{ network_ipv4_gateway }}"
 pve_lxc_dns: "{{ network_ipv4_dns }}"
 pve_lxc_ssh_port: 2222
+pve_lxc_ssh_public_key: "ssh-ed25519 AAAA...fMo"
+pve_lxc_ssh_private_key: |
+      -----BEGIN OPENSSH PRIVATE KEY-----
+      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+      QyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQAAAJi7TmCqu05g
+      qgAAAAtzc2gtZWQyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQ
+      AAAEBgO+cOwV2j8gNZ/EugDk+vbi0eGrK125vRcE3FOtJJMRDQbJ0JUtVedenMHEzoxuZE
+      gMc2MLx2pmgUeDHU+JKBAAAAEm1vbGVjdWxlLXRlc3Qtb25seQECAw==
+      -----END OPENSSH PRIVATE KEY-----
 
 cgit_hostname: "git.home.arpa"
 cgit_title: "git.example.com"
diff --git a/host_vars/proxy.home.arpa.yml b/host_vars/proxy.home.arpa.yml
index 7610c7d5..55be6bee 100644
--- a/host_vars/proxy.home.arpa.yml
+++ b/host_vars/proxy.home.arpa.yml
diff --git a/host_vars/proxy.home.arpa.yml.example b/host_vars/proxy.home.arpa.yml.example
index 902c38d2..9add250a 100644
--- a/host_vars/proxy.home.arpa.yml.example
+++ b/host_vars/proxy.home.arpa.yml.example
@@ -13,5 +13,14 @@ pve_lxc_ip: "{{ network_ipv4_address }}/24"
 pve_lxc_gateway: "{{ network_ipv4_gateway }}"
 pve_lxc_dns: "{{ network_ipv4_dns }}"
 pve_lxc_ssh_port: 2222
+pve_lxc_ssh_public_key: "ssh-ed25519 AAAA...fMo"
+pve_lxc_ssh_private_key: |
+      -----BEGIN OPENSSH PRIVATE KEY-----
+      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+      QyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQAAAJi7TmCqu05g
+      qgAAAAtzc2gtZWQyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQ
+      AAAEBgO+cOwV2j8gNZ/EugDk+vbi0eGrK125vRcE3FOtJJMRDQbJ0JUtVedenMHEzoxuZE
+      gMc2MLx2pmgUeDHU+JKBAAAAEm1vbGVjdWxlLXRlc3Qtb25seQECAw==
+      -----END OPENSSH PRIVATE KEY-----
 
 proxy_type: "caddy"
diff --git a/roles/pve-lxc-ssh/meta/argument_specs.yml b/roles/pve-lxc-ssh/meta/argument_specs.yml
index 6f03937d..5a840670 100644
--- a/roles/pve-lxc-ssh/meta/argument_specs.yml
+++ b/roles/pve-lxc-ssh/meta/argument_specs.yml
@@ -10,3 +10,11 @@ argument_specs:
         type: "int"
         default: 2222
         description: "SSH port to configure inside the container"
+      pve_lxc_ssh_private_key:
+        type: "str"
+        required: true
+        description: "Pre-generated Ed25519 host private key (OpenSSH format), unique per container"
+      pve_lxc_ssh_public_key:
+        type: "str"
+        required: true
+        description: "Pre-generated Ed25519 host public key matching pve_lxc_ssh_private_key"
diff --git a/roles/pve-lxc-ssh/tasks/main.yml b/roles/pve-lxc-ssh/tasks/main.yml
index f5d402bc..bf29ad51 100644
--- a/roles/pve-lxc-ssh/tasks/main.yml
+++ b/roles/pve-lxc-ssh/tasks/main.yml
@@ -34,13 +34,23 @@
           esac;'
       changed_when: true
 
-    - name: "Generate ssh host keys"
+    - name: "Deploy ssh host private key"
       become: true
+      no_log: true
       ansible.builtin.command:
         cmd: >
           pct exec {{ pve_lxc_id }} -- sh -c
-          '[ -f /etc/ssh/ssh_host_ed25519_key ] && exit 0;
-          ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "" -N "";'
+          'umask 077; cat > /etc/ssh/ssh_host_ed25519_key'
+        stdin: "{{ pve_lxc_ssh_private_key | trim }}\n"
+      changed_when: true
+
+    - name: "Deploy ssh host public key"
+      become: true
+      ansible.builtin.command:
+        cmd: >
+          pct exec {{ pve_lxc_id }} -- sh -c
+          'cat > /etc/ssh/ssh_host_ed25519_key.pub; chmod 0644 /etc/ssh/ssh_host_ed25519_key.pub'
+        stdin: "{{ pve_lxc_ssh_public_key | trim }}\n"
       changed_when: true
 
     - name: "Render sshd_config"