From 19ae38db9c3ce3e1dac4ca8ce454c59a58619100 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Sun, 26 Jul 2026 03:48:12 +0200
Subject: Reconcile pve-lxc-ssh config every run, not just on first install
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pve_lxc_ssh_check.rc != 0 gated the entire block, so once openssh was
installed, sshd_config pushes, host key deploys, and service enable/
restart never ran again on reconverge — template changes (e.g. sshd
hardening) silently never reached already-provisioned containers.
Narrow the conditional to just the package-install step; everything
else already idempotent, runs unconditionally now.

Co-Authored-By: Claude.ai
---
 roles/pve-lxc-ssh/tasks/main.yml | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/roles/pve-lxc-ssh/tasks/main.yml b/roles/pve-lxc-ssh/tasks/main.yml
index bf29ad51..8a1dd095 100644
--- a/roles/pve-lxc-ssh/tasks/main.yml
+++ b/roles/pve-lxc-ssh/tasks/main.yml
@@ -16,26 +16,28 @@
   tags:
     - "molecule-notest"
 
-- name: "Install openssh and configure openssh"
+- name: "Install openssh"
   become: true
   tags:
     - "molecule-notest"
   when: pve_lxc_ssh_check.rc != 0
-  block:
-    - name: "Install openssh"
-      ansible.builtin.command:
-        cmd: >
-          pct exec {{ pve_lxc_id }} -- sh -c '
-          . /etc/os-release;
-          case $ID in
-            alpine) apk add --no-cache openssh ;;
-            debian|ubuntu) apt-get install -y openssh-server ;;
-            *) echo "Unsupported distro: $ID" && exit 1 ;;
-          esac;'
-      changed_when: true
+  ansible.builtin.command:
+    cmd: >
+      pct exec {{ pve_lxc_id }} -- sh -c '
+      . /etc/os-release;
+      case $ID in
+        alpine) apk add --no-cache openssh ;;
+        debian|ubuntu) apt-get install -y openssh-server ;;
+        *) echo "Unsupported distro: $ID" && exit 1 ;;
+      esac;'
+  changed_when: true
 
+- name: "Configure openssh"
+  become: true
+  tags:
+    - "molecule-notest"
+  block:
     - name: "Deploy ssh host private key"
-      become: true
       no_log: true
       ansible.builtin.command:
         cmd: >
@@ -45,7 +47,6 @@
       changed_when: true
 
     - name: "Deploy ssh host public key"
-      become: true
       ansible.builtin.command:
         cmd: >
           pct exec {{ pve_lxc_id }} -- sh -c
@@ -60,7 +61,6 @@
         mode: "0600"
 
     - name: "Push sshd_config into container"
-      become: true
       ansible.builtin.command:
         cmd: pct push {{ pve_lxc_id }} /tmp/sshd_config_{{ pve_lxc_id }} /etc/ssh/sshd_config --perms 0640
       changed_when: true
@@ -71,7 +71,6 @@
         state: absent
 
     - name: "Enable and start sshd"
-      become: true
       ansible.builtin.command:
         cmd: >
           pct exec {{ pve_lxc_id }} -- sh -c
-- 
cgit v1.2.3