From 87c598e0adb88581982bfa59375bdd1a7fe53969 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Sun, 26 Jul 2026 00:58:07 +0200 Subject: Change the ssh role to only inject pre-generated keys Co-Authored-By: Claude.ai --- roles/ssh/tasks/main.yml | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'roles/ssh/tasks') diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml index f60c2640..d5cf8db3 100644 --- a/roles/ssh/tasks/main.yml +++ b/roles/ssh/tasks/main.yml @@ -8,11 +8,25 @@ name: "{{ ssh_package }}" state: "present" -- name: "Generate /etc/ssh/ Ed25519 host key" +- name: "Deploy /etc/ssh/ Ed25519 host private key" become: true - ansible.builtin.command: - cmd: "ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C '' -N ''" - creates: "/etc/ssh/ssh_host_ed25519_key" + no_log: true + ansible.builtin.copy: + dest: "/etc/ssh/ssh_host_ed25519_key" + content: "{{ ssh_private_key | trim }}\n" + owner: "root" + group: "root" + mode: "0600" + notify: "Restart ssh" + +- name: "Deploy /etc/ssh/ Ed25519 host public key" + become: true + ansible.builtin.copy: + dest: "/etc/ssh/ssh_host_ed25519_key.pub" + content: "{{ ssh_public_key | trim }}\n" + owner: "root" + group: "root" + mode: "0644" - name: "Ensure ssh service is enabled" become: true -- cgit v1.2.3