fix(ssh): use inline SSH key content

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/ansible-linters.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5.0.0
     - name: Run ansible-lint
       uses: ansible/ansible-lint@v25.2.1
       with:

.gitea/workflows/release.yaml

@@ -0,0 +1,22 @@
+name: Release Ansible Role
+
+on:
+  push:
+    tags:
+    - '**'
+  workflow_dispatch: {}
+
+jobs:
+  release:
+    name: Release Ansible Role
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install Ansible Galaxy
+      run: |
+        apt update --yes
+        apt install --yes ansible
+    - env:
+        ANSIBLE_GALAXY_TOKEN: ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
+      name: Update Ansible Role in Ansible Galaxy
+      run: |
+        ansible-galaxy role import --token=${ANSIBLE_GALAXY_TOKEN} volker-raschek ${GITHUB_REPOSITORY#*/}

.vscode/settings.json

@@ -3,12 +3,12 @@
   "files.associations": {
     "**/.gitea/**/*.yml": "yaml",
     "**/.gitea/**/*.yaml": "yaml",
-    ".drone.yml": "yaml",
     "docker-compose*.yml": "dockercompose",
     "*.yml": "ansible",
     "*.yaml": "ansible",
     ".yamllint": "yaml",
     ".yamllint.yml": "yaml",
     ".yamllint.yaml": "yaml"
-  }
+  },
+  "rewrap.wrappingColumn": 120
 }

default/main.yaml

@@ -0,0 +1,18 @@
+---
+
+root: {}
+#   password: ""
+#   ssh:
+#     config:
+#     - Host: "*"
+#       StrictHostKeyChecking: "no"
+#       UserKnownHostFile: /dev/null
+#     authorized_keys:
+#     - content: ssh-ed25519 AAAAC3NzaC... alice
+#       # command: "" # optional
+#     private_keys:
+#     - filename: alice@alice-pc.ed25519.key
+#       content: |
+#         -----BEGIN OPENSSH PRIVATE KEY-----
+#         ...
+#         -----END OPENSSH PRIVATE KEY-----

default/main.yml

@@ -1,12 +0,0 @@
----
-
-root: {}
-#   password: ""
-#   ssh:
-#     config:
-#     - Host: "*"
-#       StrictHostKeyChecking: "no"
-#       UserKnownHostFile: /dev/null
-#     authorized_keys:
-#     - filename: markus@markus-pc.pub
-#       # command: "" # optional

tasks/main.yaml

@@ -80,24 +80,27 @@
   block:
   - name: "Create private SSH keys"
     ansible.builtin.copy:
-      src: "{{ playbook_dir }}/ssh/private_keys/{{ item }}"
-      dest: "/root/.ssh/{{ item }}"
+      content: "{{ item.content }}"
+      dest: "/root/.ssh/{{ item.filename }}"
       owner: "root"
       group: "root"
       mode: "0600"
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
   - name: "Extract public SSH keys from private keys"
     ansible.builtin.shell:
     args:
       executable: /bin/bash
-      cmd: "ssh-keygen -y -f /root/.ssh/{{ item }} > /root/.ssh/{{ item }}.pub"
+      cmd: "ssh-keygen -y -f {{ ('/root/.ssh/' + item.filename) | quote }} > {{ ('/root/.ssh/' + item.filename + '.pub') | quote }}"
+      creates: "/root/.ssh/{{ item.filename }}.pub"
     register: _root_ssh_pub_key_extraction
     changed_when: _root_ssh_pub_key_extraction.rc == 0
     failed_when: _root_ssh_pub_key_extraction.rc > 0
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
 - name: "Create custom SSH client config"
   ansible.builtin.template:

templates/root/.ssh/authorized_keys.j2

@@ -3,8 +3,8 @@
 #
 {% for authorized_key in root.ssh.authorized_keys %}
 {% if authorized_key.command is defined and authorized_key.command | length > 0 %}
-command="{{ authorized_key.command }}" {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+command="{{ authorized_key.command }}" {{ authorized_key.content | trim }}
 {% else %}
-{{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+{{ authorized_key.content | trim }}
 {% endif %}
 {% endfor %}