3 files changed, 30 insertions, 5 deletions
diff --git a/roles/ssh/README.md b/roles/ssh/README.md
index 7786808a..f61da5cf 100644
--- a/roles/ssh/README.md
+++ b/roles/ssh/README.md
@@ -6,11 +6,14 @@ This role configure the ssh functionality of a linux distro with hardening
 
 - `username` the user account to be added to the ssh allowed users.
 - `ssh_port` the port number to be enabled for ssh (default: 2222)
+- `ssh_private_key` pre-generated Ed25519 host private key, unique per host. Generate with:
+  `ssh-keygen -t ed25519 -f host_key -C '' -N ''`
+- `ssh_public_key` matching pre-generated Ed25519 host public key
 
 ## Internals
 
 - ensure that ssh packages is installed and enabled
-- configure ssh host keys
+- deploy pre-generated ssh host keys (stable across reprovision/reimage, no key regeneration on each setup)
 - configure ssh defaults
   - disable keyboard interactive authentication
   - disable PAM authentication
diff --git a/roles/ssh/meta/argument_specs.yml b/roles/ssh/meta/argument_specs.yml
index 43aa0d43..81ab218f 100644
--- a/roles/ssh/meta/argument_specs.yml
+++ b/roles/ssh/meta/argument_specs.yml
@@ -16,3 +16,11 @@ argument_specs:
         elements: "str"
         required: false
         description: "List of SSH known_hosts entries in 'hostname keytype keydata' format"
+      ssh_private_key:
+        type: "str"
+        required: true
+        description: "Pre-generated Ed25519 host private key (OpenSSH format), unique per host"
+      ssh_public_key:
+        type: "str"
+        required: true
+        description: "Pre-generated Ed25519 host public key matching ssh_private_key"
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
index f60c2640..d5cf8db3 100644
--- a/roles/ssh/tasks/main.yml
+++ b/roles/ssh/tasks/main.yml
@@ -8,11 +8,25 @@
     name: "{{ ssh_package }}"
     state: "present"
 
-- name: "Generate /etc/ssh/ Ed25519 host key"
+- name: "Deploy /etc/ssh/ Ed25519 host private key"
   become: true
-  ansible.builtin.command:
-    cmd: "ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C '' -N ''"
-    creates: "/etc/ssh/ssh_host_ed25519_key"
+  no_log: true
+  ansible.builtin.copy:
+    dest: "/etc/ssh/ssh_host_ed25519_key"
+    content: "{{ ssh_private_key | trim }}\n"
+    owner: "root"
+    group: "root"
+    mode: "0600"
+  notify: "Restart ssh"
+
+- name: "Deploy /etc/ssh/ Ed25519 host public key"
+  become: true
+  ansible.builtin.copy:
+    dest: "/etc/ssh/ssh_host_ed25519_key.pub"
+    content: "{{ ssh_public_key | trim }}\n"
+    owner: "root"
+    group: "root"
+    mode: "0644"
 
 - name: "Ensure ssh service is enabled"
   become: true