fix(ssh)!: refresh public keys after key rotation

Derive public keys on every run and update their files only when the content changes, so existing public keys cannot become stale. BREAKING CHANGE: The role no longer generates a key pair automatically when root.ssh.private_keys is empty or omitted. Provide private keys explicitly when needed. Co-authored-by: Copilot <copilot@github.com>
2026-10-18 14:46:48 +02:00
1 parent 44716aa722
commit c2f50c4423
@@ -0,0 +1,104 @@
+---
+
+- name: Set or unset root password
+  block:
+  - name: Set root password
+    ansible.builtin.user:
+      name: root
+      password: "{{ root.password | password_hash('sha512') }}"
+      password_lock: false
+    when: root.password is defined and root.password | length > 0 and root.password != "!"
+    no_log: true
+
+  - name: Update ansible_become_pass
+    ansible.builtin.set_fact:
+      ansible_become_pass: "{{ root.password }}"
+    when: root.password is defined and root.password | length > 0 and root.password != "!"
+    no_log: true
+
+  - name: Lock root login
+    ansible.builtin.user:
+      name: root
+      password_lock: true
+    when: root.password is defined and root.password | length <= 0
+
+- name: Create .ssh directory
+  ansible.builtin.file:
+    path: "/root/.ssh"
+    state: directory
+    owner: "root"
+    group: "root"
+    mode: "0700"
+
+- name: "Create authorized_keys file"
+  ansible.builtin.template:
+    src: root/.ssh/authorized_keys.j2
+    dest: "/root/.ssh/authorized_keys"
+    owner: "root"
+    group: "root"
+    mode: "0600"
+  when: root.ssh is defined and
+        root.ssh.authorized_keys is defined and
+        root.ssh.authorized_keys | length > 0
+
+- name: "Remove authorized_keys file"
+  ansible.builtin.file:
+    path: "/root/.ssh/authorized_keys"
+    state: absent
+  when: root.ssh is defined and
+        root.ssh.authorized_keys is defined and
+        root.ssh.authorized_keys | length <= 0 or
+        root.ssh is defined and
+        root.ssh.authorized_keys is not defined or
+        root.ssh is not defined
+
+- name: "Create private and public SSH key"
+  when: root.ssh is defined and
+        root.ssh.private_keys is defined and
+        root.ssh.private_keys | length > 0
+  block:
+  - name: "Create private SSH keys"
+    ansible.builtin.copy:
+      content: "{{ item.content }}"
+      dest: "/root/.ssh/{{ item.filename }}"
+      owner: "root"
+      group: "root"
+      mode: "0600"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
+
+  - name: "Extract public SSH keys from private keys"
+    ansible.builtin.command:
+      argv: [ "ssh-keygen", "-y", "-f", "/root/.ssh/{{ item.filename }}" ]
+    register: _root_ssh_pub_key_extraction
+    changed_when: false
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
+
+  - name: "Write derived public SSH keys"
+    ansible.builtin.copy:
+      content: "{{ item.stdout }}\n"
+      dest: "/root/.ssh/{{ item.item.filename }}.pub"
+      owner: "root"
+      group: "root"
+      mode: "0644"
+    loop: "{{ _root_ssh_pub_key_extraction.results }}"
+    loop_control:
+      label: "{{ item.item.filename }}"
+
+- name: "Create custom SSH client config"
+  ansible.builtin.template:
+    src: root/.ssh/config.j2
+    dest: /root/.ssh/config
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  when: root.ssh.config is defined and root.ssh.config | length >= 0
+
+- name: "Remove custom SSH client config"
+  ansible.builtin.file:
+    path: "/root/.ssh/config"
+    state: absent
+  when: root.ssh.config is not defined