diff options
| -rw-r--r-- | configure.yml | 2 | ||||
| -rw-r--r-- | group_vars/all.yml | bin | 898 -> 1118 bytes | |||
| -rw-r--r-- | host_vars/git.home.arpa.yml | bin | 1009 -> 1544 bytes | |||
| -rw-r--r-- | host_vars/git.home.arpa.yml.example | 9 | ||||
| -rw-r--r-- | host_vars/proxy.home.arpa.yml | bin | 699 -> 1234 bytes | |||
| -rw-r--r-- | host_vars/proxy.home.arpa.yml.example | 9 | ||||
| -rw-r--r-- | roles/pve-lxc-ssh/meta/argument_specs.yml | 8 | ||||
| -rw-r--r-- | roles/pve-lxc-ssh/tasks/main.yml | 16 |
8 files changed, 41 insertions, 3 deletions
diff --git a/configure.yml b/configure.yml index 647c0204..e707dfab 100644 --- a/configure.yml +++ b/configure.yml @@ -152,6 +152,8 @@ vars: pve_lxc_id: "{{ hostvars[service_host].pve_lxc_id }}" pve_lxc_ssh_port: "{{ hostvars[service_host].pve_lxc_ssh_port }}" + pve_lxc_ssh_private_key: "{{ hostvars[service_host].pve_lxc_ssh_private_key }}" + pve_lxc_ssh_public_key: "{{ hostvars[service_host].pve_lxc_ssh_public_key }}" loop: "{{ groups['containers'] }}" loop_control: loop_var: "service_host" diff --git a/group_vars/all.yml b/group_vars/all.yml Binary files differindex d5a8a535..f39487b7 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml diff --git a/host_vars/git.home.arpa.yml b/host_vars/git.home.arpa.yml Binary files differindex 5dc2b143..ef0d2d6c 100644 --- a/host_vars/git.home.arpa.yml +++ b/host_vars/git.home.arpa.yml diff --git a/host_vars/git.home.arpa.yml.example b/host_vars/git.home.arpa.yml.example index fe14f69d..cd3a464c 100644 --- a/host_vars/git.home.arpa.yml.example +++ b/host_vars/git.home.arpa.yml.example @@ -13,6 +13,15 @@ pve_lxc_ip: "{{ network_ipv4_address }}/24" pve_lxc_gateway: "{{ network_ipv4_gateway }}" pve_lxc_dns: "{{ network_ipv4_dns }}" pve_lxc_ssh_port: 2222 +pve_lxc_ssh_public_key: "ssh-ed25519 AAAA...fMo" +pve_lxc_ssh_private_key: | + -----BEGIN OPENSSH PRIVATE KEY----- + b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW + QyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQAAAJi7TmCqu05g + qgAAAAtzc2gtZWQyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQ + AAAEBgO+cOwV2j8gNZ/EugDk+vbi0eGrK125vRcE3FOtJJMRDQbJ0JUtVedenMHEzoxuZE + gMc2MLx2pmgUeDHU+JKBAAAAEm1vbGVjdWxlLXRlc3Qtb25seQECAw== + -----END OPENSSH PRIVATE KEY----- cgit_hostname: "git.home.arpa" cgit_title: "git.example.com" diff --git a/host_vars/proxy.home.arpa.yml b/host_vars/proxy.home.arpa.yml Binary files differindex 7610c7d5..55be6bee 100644 --- a/host_vars/proxy.home.arpa.yml +++ b/host_vars/proxy.home.arpa.yml diff --git a/host_vars/proxy.home.arpa.yml.example b/host_vars/proxy.home.arpa.yml.example index 902c38d2..9add250a 100644 --- a/host_vars/proxy.home.arpa.yml.example +++ b/host_vars/proxy.home.arpa.yml.example @@ -13,5 +13,14 @@ pve_lxc_ip: "{{ network_ipv4_address }}/24" pve_lxc_gateway: "{{ network_ipv4_gateway }}" pve_lxc_dns: "{{ network_ipv4_dns }}" pve_lxc_ssh_port: 2222 +pve_lxc_ssh_public_key: "ssh-ed25519 AAAA...fMo" +pve_lxc_ssh_private_key: | + -----BEGIN OPENSSH PRIVATE KEY----- + b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW + QyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQAAAJi7TmCqu05g + qgAAAAtzc2gtZWQyNTUxOQAAACAQ0GydCVLVXnXpzBxM6MbmRIDHNjC8dqZoFHgx1PiSgQ + AAAEBgO+cOwV2j8gNZ/EugDk+vbi0eGrK125vRcE3FOtJJMRDQbJ0JUtVedenMHEzoxuZE + gMc2MLx2pmgUeDHU+JKBAAAAEm1vbGVjdWxlLXRlc3Qtb25seQECAw== + -----END OPENSSH PRIVATE KEY----- proxy_type: "caddy" diff --git a/roles/pve-lxc-ssh/meta/argument_specs.yml b/roles/pve-lxc-ssh/meta/argument_specs.yml index 6f03937d..5a840670 100644 --- a/roles/pve-lxc-ssh/meta/argument_specs.yml +++ b/roles/pve-lxc-ssh/meta/argument_specs.yml @@ -10,3 +10,11 @@ argument_specs: type: "int" default: 2222 description: "SSH port to configure inside the container" + pve_lxc_ssh_private_key: + type: "str" + required: true + description: "Pre-generated Ed25519 host private key (OpenSSH format), unique per container" + pve_lxc_ssh_public_key: + type: "str" + required: true + description: "Pre-generated Ed25519 host public key matching pve_lxc_ssh_private_key" diff --git a/roles/pve-lxc-ssh/tasks/main.yml b/roles/pve-lxc-ssh/tasks/main.yml index f5d402bc..bf29ad51 100644 --- a/roles/pve-lxc-ssh/tasks/main.yml +++ b/roles/pve-lxc-ssh/tasks/main.yml @@ -34,13 +34,23 @@ esac;' changed_when: true - - name: "Generate ssh host keys" + - name: "Deploy ssh host private key" become: true + no_log: true ansible.builtin.command: cmd: > pct exec {{ pve_lxc_id }} -- sh -c - '[ -f /etc/ssh/ssh_host_ed25519_key ] && exit 0; - ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "" -N "";' + 'umask 077; cat > /etc/ssh/ssh_host_ed25519_key' + stdin: "{{ pve_lxc_ssh_private_key | trim }}\n" + changed_when: true + + - name: "Deploy ssh host public key" + become: true + ansible.builtin.command: + cmd: > + pct exec {{ pve_lxc_id }} -- sh -c + 'cat > /etc/ssh/ssh_host_ed25519_key.pub; chmod 0644 /etc/ssh/ssh_host_ed25519_key.pub' + stdin: "{{ pve_lxc_ssh_public_key | trim }}\n" changed_when: true - name: "Render sshd_config" |