From 14984e7469e0579effce2907722399179fd01167 Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Sat, 17 Oct 2026 23:17:59 +0200
Subject: [PATCH] fix(ssh): use inline SSH key content

Co-authored-by: Copilot <copilot@github.com>
---
 default/main.yaml                      |  8 +++++++-
 tasks/main.yaml                        | 17 ++++++++++-------
 templates/root/.ssh/authorized_keys.j2 |  4 ++--
 3 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/default/main.yaml b/default/main.yaml
index bbbdbfc..4252096 100644
--- a/default/main.yaml
+++ b/default/main.yaml
@@ -8,5 +8,11 @@ root: {}
 #       StrictHostKeyChecking: "no"
 #       UserKnownHostFile: /dev/null
 #     authorized_keys:
-#     - filename: markus@markus-pc.pub
+#     - content: ssh-ed25519 AAAAC3NzaC... alice
 #       # command: "" # optional
+#     private_keys:
+#     - filename: alice@alice-pc.ed25519.key
+#       content: |
+#         -----BEGIN OPENSSH PRIVATE KEY-----
+#         ...
+#         -----END OPENSSH PRIVATE KEY-----
diff --git a/tasks/main.yaml b/tasks/main.yaml
index 5457063..308f87d 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -80,24 +80,27 @@
   block:
   - name: "Create private SSH keys"
     ansible.builtin.copy:
-      src: "{{ playbook_dir }}/ssh/private_keys/{{ item }}"
-      dest: "/root/.ssh/{{ item }}"
+      content: "{{ item.content }}"
+      dest: "/root/.ssh/{{ item.filename }}"
       owner: "root"
       group: "root"
       mode: "0600"
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
   - name: "Extract public SSH keys from private keys"
     ansible.builtin.shell:
     args:
       executable: /bin/bash
-      cmd: "ssh-keygen -y -f /root/.ssh/{{ item }} > /root/.ssh/{{ item }}.pub"
+      cmd: "ssh-keygen -y -f {{ ('/root/.ssh/' + item.filename) | quote }} > {{ ('/root/.ssh/' + item.filename + '.pub') | quote }}"
+      creates: "/root/.ssh/{{ item.filename }}.pub"
     register: _root_ssh_pub_key_extraction
     changed_when: _root_ssh_pub_key_extraction.rc == 0
     failed_when: _root_ssh_pub_key_extraction.rc > 0
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
 - name: "Create custom SSH client config"
   ansible.builtin.template:
diff --git a/templates/root/.ssh/authorized_keys.j2 b/templates/root/.ssh/authorized_keys.j2
index 13d3c4f..0bdd818 100644
--- a/templates/root/.ssh/authorized_keys.j2
+++ b/templates/root/.ssh/authorized_keys.j2
@@ -3,8 +3,8 @@
 #
 {% for authorized_key in root.ssh.authorized_keys %}
 {% if authorized_key.command is defined and authorized_key.command | length > 0 %}
-command="{{ authorized_key.command }}" {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+command="{{ authorized_key.command }}" {{ authorized_key.content | trim }}
 {% else %}
-{{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+{{ authorized_key.content | trim }}
 {% endif %}
 {% endfor %}