From c2f50c4423397c099e1b7ab48599e241b8d47274 Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Sun, 18 Oct 2026 14:46:48 +0200
Subject: [PATCH] fix(ssh)!: refresh public keys after key rotation

Derive public keys on every run and update their files only when the content changes, so existing public keys cannot become stale.

BREAKING CHANGE: The role no longer generates a key pair automatically when root.ssh.private_keys is empty or omitted. Provide private keys explicitly when needed.

Co-authored-by: Copilot <copilot@github.com>
---
 tasks/{main.yaml => main.yml} | 42 ++++++++++++-----------------------
 1 file changed, 14 insertions(+), 28 deletions(-)
 rename tasks/{main.yaml => main.yml} (71%)

diff --git a/tasks/main.yaml b/tasks/main.yml
similarity index 71%
rename from tasks/main.yaml
rename to tasks/main.yml
index 308f87d..ac4d35d 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yml
@@ -52,27 +52,6 @@
         root.ssh.authorized_keys is not defined or
         root.ssh is not defined
 
-- name: "Generate private and public SSH key"
-  when: root.ssh is defined and
-        (
-          root.ssh.private_keys is not defined or
-          root.ssh.private_keys | length <= 0
-        )
-  block:
-  - name: "Check if private SSH key already exists"
-    ansible.builtin.stat:
-      path: "/root/.ssh/{{ inventory_hostname_short }}.key"
-    register: stat_result
-  - name: "Generate private SSH key"
-    community.crypto.openssh_keypair:
-      path: "/root/.ssh/{{ inventory_hostname_short }}.key"
-      type: ed25519
-      size: 512
-      state: present
-      comment: "root@{{ inventory_hostname_short }}"
-      force: false
-    when: not stat_result.stat.exists
-
 - name: "Create private and public SSH key"
   when: root.ssh is defined and
         root.ssh.private_keys is defined and
@@ -90,18 +69,25 @@
       label: "{{ item.filename }}"
 
   - name: "Extract public SSH keys from private keys"
-    ansible.builtin.shell:
-    args:
-      executable: /bin/bash
-      cmd: "ssh-keygen -y -f {{ ('/root/.ssh/' + item.filename) | quote }} > {{ ('/root/.ssh/' + item.filename + '.pub') | quote }}"
-      creates: "/root/.ssh/{{ item.filename }}.pub"
+    ansible.builtin.command:
+      argv: [ "ssh-keygen", "-y", "-f", "/root/.ssh/{{ item.filename }}" ]
     register: _root_ssh_pub_key_extraction
-    changed_when: _root_ssh_pub_key_extraction.rc == 0
-    failed_when: _root_ssh_pub_key_extraction.rc > 0
+    changed_when: false
     loop: "{{ root.ssh.private_keys }}"
     loop_control:
       label: "{{ item.filename }}"
 
+  - name: "Write derived public SSH keys"
+    ansible.builtin.copy:
+      content: "{{ item.stdout }}\n"
+      dest: "/root/.ssh/{{ item.item.filename }}.pub"
+      owner: "root"
+      group: "root"
+      mode: "0644"
+    loop: "{{ _root_ssh_pub_key_extraction.results }}"
+    loop_control:
+      label: "{{ item.item.filename }}"
+
 - name: "Create custom SSH client config"
   ansible.builtin.template:
     src: root/.ssh/config.j2