diff options
| author | Ahmed Abdelhalim <[email protected]> | 2025-11-09 00:46:18 +0100 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2025-11-09 01:47:00 +0100 |
| commit | aa8d8855e0a153245f2ad0832ebeea80af57cbfb (patch) | |
| tree | b82a681774708915299f6cf2288c9a8ab836eec3 /roles/ssh | |
| parent | 399826fd634e47134feb919b0ee0805035475fc4 (diff) | |
Refactor scattered known_hosts to be part of the ssh role
Diffstat (limited to 'roles/ssh')
| -rw-r--r-- | roles/ssh/defaults/main.yml | 3 | ||||
| -rw-r--r-- | roles/ssh/meta/argument_specs.yml | 5 | ||||
| -rw-r--r-- | roles/ssh/tasks/main.yml | 9 |
3 files changed, 17 insertions, 0 deletions
diff --git a/roles/ssh/defaults/main.yml b/roles/ssh/defaults/main.yml index a3f3e329..ac2ff59f 100644 --- a/roles/ssh/defaults/main.yml +++ b/roles/ssh/defaults/main.yml @@ -1,2 +1,5 @@ --- ssh_port: 2222 +ssh_known_hosts: + - "git.sr.ht ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60" + - "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" diff --git a/roles/ssh/meta/argument_specs.yml b/roles/ssh/meta/argument_specs.yml index 7581a905..a2e1721e 100644 --- a/roles/ssh/meta/argument_specs.yml +++ b/roles/ssh/meta/argument_specs.yml @@ -13,3 +13,8 @@ argument_specs: required: false default: 2222 description: "The default ssh port configuration (to avoid port 22 pwn/testing)" + ssh_known_hosts: + type: "list" + elements: "str" + required: false + description: "List of SSH known_hosts entries in 'hostname keytype keydata' format" diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml index 9728e303..76ba7aa5 100644 --- a/roles/ssh/tasks/main.yml +++ b/roles/ssh/tasks/main.yml @@ -94,3 +94,12 @@ AllowUsers {{ username }} notify: - "Restart ssh" + +- name: "Configure known_hosts" + ansible.builtin.known_hosts: + name: "{{ item.split(' ') | first }}" + key: "{{ item }}" + path: "{{ ansible_env.HOME }}/.ssh/known_hosts" + state: present + loop: "{{ ssh_known_hosts }}" + when: ssh_known_hosts is defined and ssh_known_hosts | length > 0 |