fix(ssh): use inline SSH key content

Co-authored-by: Copilot <copilot@github.com>

default/main.yaml

@@ -8,5 +8,11 @@ root: {}
 #       StrictHostKeyChecking: "no"
 #       UserKnownHostFile: /dev/null
 #     authorized_keys:
-#     - filename: markus@markus-pc.pub
+#     - content: ssh-ed25519 AAAAC3NzaC... alice
 #       # command: "" # optional
+#     private_keys:
+#     - filename: alice@alice-pc.ed25519.key
+#       content: |
+#         -----BEGIN OPENSSH PRIVATE KEY-----
+#         ...
+#         -----END OPENSSH PRIVATE KEY-----

tasks/main.yaml

@@ -80,24 +80,27 @@
   block:
   - name: "Create private SSH keys"
     ansible.builtin.copy:
-      src: "{{ playbook_dir }}/ssh/private_keys/{{ item }}"
-      dest: "/root/.ssh/{{ item }}"
+      content: "{{ item.content }}"
+      dest: "/root/.ssh/{{ item.filename }}"
       owner: "root"
       group: "root"
       mode: "0600"
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
   - name: "Extract public SSH keys from private keys"
     ansible.builtin.shell:
     args:
       executable: /bin/bash
-      cmd: "ssh-keygen -y -f /root/.ssh/{{ item }} > /root/.ssh/{{ item }}.pub"
+      cmd: "ssh-keygen -y -f {{ ('/root/.ssh/' + item.filename) | quote }} > {{ ('/root/.ssh/' + item.filename + '.pub') | quote }}"
+      creates: "/root/.ssh/{{ item.filename }}.pub"
     register: _root_ssh_pub_key_extraction
     changed_when: _root_ssh_pub_key_extraction.rc == 0
     failed_when: _root_ssh_pub_key_extraction.rc > 0
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
 - name: "Create custom SSH client config"
   ansible.builtin.template:

templates/root/.ssh/authorized_keys.j2

@@ -3,8 +3,8 @@
 #
 {% for authorized_key in root.ssh.authorized_keys %}
 {% if authorized_key.command is defined and authorized_key.command | length > 0 %}
-command="{{ authorized_key.command }}" {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+command="{{ authorized_key.command }}" {{ authorized_key.content | trim }}
 {% else %}
-{{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+{{ authorized_key.content | trim }}
 {% endif %}
 {% endfor %}