From aa8d8855e0a153245f2ad0832ebeea80af57cbfb Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Sun, 9 Nov 2025 00:46:18 +0100
Subject: Refactor scattered known_hosts to be part of the ssh role

---
 roles/ssh/defaults/main.yml       | 3 +++
 roles/ssh/meta/argument_specs.yml | 5 +++++
 roles/ssh/tasks/main.yml          | 9 +++++++++
 3 files changed, 17 insertions(+)

(limited to 'roles/ssh')

diff --git a/roles/ssh/defaults/main.yml b/roles/ssh/defaults/main.yml
index a3f3e329..ac2ff59f 100644
--- a/roles/ssh/defaults/main.yml
+++ b/roles/ssh/defaults/main.yml
@@ -1,2 +1,5 @@
 ---
 ssh_port: 2222
+ssh_known_hosts:
+  - "git.sr.ht ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60"
+  - "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
diff --git a/roles/ssh/meta/argument_specs.yml b/roles/ssh/meta/argument_specs.yml
index 7581a905..a2e1721e 100644
--- a/roles/ssh/meta/argument_specs.yml
+++ b/roles/ssh/meta/argument_specs.yml
@@ -13,3 +13,8 @@ argument_specs:
         required: false
         default: 2222
         description: "The default ssh port configuration (to avoid port 22 pwn/testing)"
+      ssh_known_hosts:
+        type: "list"
+        elements: "str"
+        required: false
+        description: "List of SSH known_hosts entries in 'hostname keytype keydata' format"
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
index 9728e303..76ba7aa5 100644
--- a/roles/ssh/tasks/main.yml
+++ b/roles/ssh/tasks/main.yml
@@ -94,3 +94,12 @@
       AllowUsers {{ username }}
   notify:
     - "Restart ssh"
+
+- name: "Configure known_hosts"
+  ansible.builtin.known_hosts:
+    name: "{{ item.split(' ') | first }}"
+    key: "{{ item }}"
+    path: "{{ ansible_env.HOME }}/.ssh/known_hosts"
+    state: present
+  loop: "{{ ssh_known_hosts }}"
+  when: ssh_known_hosts is defined and ssh_known_hosts | length > 0
-- 
cgit v1.2.3