fix(ssh): use inline SSH key content

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/release.yaml

@@ -0,0 +1,22 @@
+name: Release Ansible Role
+
+on:
+  push:
+    tags:
+    - '**'
+  workflow_dispatch: {}
+
+jobs:
+  release:
+    name: Release Ansible Role
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install Ansible Galaxy
+      run: |
+        apt update --yes
+        apt install --yes ansible
+    - env:
+        ANSIBLE_GALAXY_TOKEN: ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
+      name: Update Ansible Role in Ansible Galaxy
+      run: |
+        ansible-galaxy role import --token=${ANSIBLE_GALAXY_TOKEN} volker-raschek ${GITHUB_REPOSITORY#*/}

.vscode/settings.json

@@ -3,12 +3,12 @@
   "files.associations": {
     "**/.gitea/**/*.yml": "yaml",
     "**/.gitea/**/*.yaml": "yaml",
-    ".drone.yml": "yaml",
     "docker-compose*.yml": "dockercompose",
     "*.yml": "ansible",
     "*.yaml": "ansible",
     ".yamllint": "yaml",
     ".yamllint.yml": "yaml",
     ".yamllint.yaml": "yaml"
-  }
+  },
+  "rewrap.wrappingColumn": 120
 }

default/main.yaml

@@ -8,5 +8,11 @@ root: {}
 #       StrictHostKeyChecking: "no"
 #       UserKnownHostFile: /dev/null
 #     authorized_keys:
-#     - filename: markus@markus-pc.pub
+#     - content: ssh-ed25519 AAAAC3NzaC... alice
 #       # command: "" # optional
+#     private_keys:
+#     - filename: alice@alice-pc.ed25519.key
+#       content: |
+#         -----BEGIN OPENSSH PRIVATE KEY-----
+#         ...
+#         -----END OPENSSH PRIVATE KEY-----

tasks/main.yaml

@@ -80,24 +80,27 @@
   block:
   - name: "Create private SSH keys"
     ansible.builtin.copy:
-      src: "{{ playbook_dir }}/ssh/private_keys/{{ item }}"
-      dest: "/root/.ssh/{{ item }}"
+      content: "{{ item.content }}"
+      dest: "/root/.ssh/{{ item.filename }}"
       owner: "root"
       group: "root"
       mode: "0600"
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
   - name: "Extract public SSH keys from private keys"
     ansible.builtin.shell:
     args:
       executable: /bin/bash
-      cmd: "ssh-keygen -y -f /root/.ssh/{{ item }} > /root/.ssh/{{ item }}.pub"
+      cmd: "ssh-keygen -y -f {{ ('/root/.ssh/' + item.filename) | quote }} > {{ ('/root/.ssh/' + item.filename + '.pub') | quote }}"
+      creates: "/root/.ssh/{{ item.filename }}.pub"
     register: _root_ssh_pub_key_extraction
     changed_when: _root_ssh_pub_key_extraction.rc == 0
     failed_when: _root_ssh_pub_key_extraction.rc > 0
-    with_items:
-    - "{{ root.ssh.private_keys }}"
+    loop: "{{ root.ssh.private_keys }}"
+    loop_control:
+      label: "{{ item.filename }}"
 
 - name: "Create custom SSH client config"
   ansible.builtin.template:

templates/root/.ssh/authorized_keys.j2

@@ -3,8 +3,8 @@
 #
 {% for authorized_key in root.ssh.authorized_keys %}
 {% if authorized_key.command is defined and authorized_key.command | length > 0 %}
-command="{{ authorized_key.command }}" {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+command="{{ authorized_key.command }}" {{ authorized_key.content | trim }}
 {% else %}
-{{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+{{ authorized_key.content | trim }}
 {% endif %}
 {% endfor %}