diff options
| author | Ahmed Abdelhalim <[email protected]> | 2026-07-26 02:23:21 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2026-07-26 02:24:38 +0200 |
| commit | bd9545a90c3a5e16046112da818afd7028a7cd22 (patch) | |
| tree | 9ab501c73e980bae15fe1aae855e3048c673665b /roles/pve-lxc-ssh | |
| parent | 2f60116a43706774f1a815d8513d0ec23e880fc2 (diff) | |
Change pve-lxc-ssh implementation to only inject pre-generated keys
Co-Authored-By: Claude.ai
Diffstat (limited to 'roles/pve-lxc-ssh')
| -rw-r--r-- | roles/pve-lxc-ssh/meta/argument_specs.yml | 8 | ||||
| -rw-r--r-- | roles/pve-lxc-ssh/tasks/main.yml | 16 |
2 files changed, 21 insertions, 3 deletions
diff --git a/roles/pve-lxc-ssh/meta/argument_specs.yml b/roles/pve-lxc-ssh/meta/argument_specs.yml index 6f03937d..5a840670 100644 --- a/roles/pve-lxc-ssh/meta/argument_specs.yml +++ b/roles/pve-lxc-ssh/meta/argument_specs.yml @@ -10,3 +10,11 @@ argument_specs: type: "int" default: 2222 description: "SSH port to configure inside the container" + pve_lxc_ssh_private_key: + type: "str" + required: true + description: "Pre-generated Ed25519 host private key (OpenSSH format), unique per container" + pve_lxc_ssh_public_key: + type: "str" + required: true + description: "Pre-generated Ed25519 host public key matching pve_lxc_ssh_private_key" diff --git a/roles/pve-lxc-ssh/tasks/main.yml b/roles/pve-lxc-ssh/tasks/main.yml index f5d402bc..bf29ad51 100644 --- a/roles/pve-lxc-ssh/tasks/main.yml +++ b/roles/pve-lxc-ssh/tasks/main.yml @@ -34,13 +34,23 @@ esac;' changed_when: true - - name: "Generate ssh host keys" + - name: "Deploy ssh host private key" become: true + no_log: true ansible.builtin.command: cmd: > pct exec {{ pve_lxc_id }} -- sh -c - '[ -f /etc/ssh/ssh_host_ed25519_key ] && exit 0; - ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "" -N "";' + 'umask 077; cat > /etc/ssh/ssh_host_ed25519_key' + stdin: "{{ pve_lxc_ssh_private_key | trim }}\n" + changed_when: true + + - name: "Deploy ssh host public key" + become: true + ansible.builtin.command: + cmd: > + pct exec {{ pve_lxc_id }} -- sh -c + 'cat > /etc/ssh/ssh_host_ed25519_key.pub; chmod 0644 /etc/ssh/ssh_host_ed25519_key.pub' + stdin: "{{ pve_lxc_ssh_public_key | trim }}\n" changed_when: true - name: "Render sshd_config" |