volker.raschekandCopilot
c2f50c4423
Derive public keys on every run and update their files only when the content changes, so existing public keys cannot become stale. BREAKING CHANGE: The role no longer generates a key pair automatically when root.ssh.private_keys is empty or omitted. Provide private keys explicitly when needed. Co-authored-by: Copilot <copilot@github.com>
105 lines
3.0 KiB
YAML
105 lines
3.0 KiB
YAML
---
|
|
|
|
- name: Set or unset root password
|
|
block:
|
|
- name: Set root password
|
|
ansible.builtin.user:
|
|
name: root
|
|
password: "{{ root.password | password_hash('sha512') }}"
|
|
password_lock: false
|
|
when: root.password is defined and root.password | length > 0 and root.password != "!"
|
|
no_log: true
|
|
|
|
- name: Update ansible_become_pass
|
|
ansible.builtin.set_fact:
|
|
ansible_become_pass: "{{ root.password }}"
|
|
when: root.password is defined and root.password | length > 0 and root.password != "!"
|
|
no_log: true
|
|
|
|
- name: Lock root login
|
|
ansible.builtin.user:
|
|
name: root
|
|
password_lock: true
|
|
when: root.password is defined and root.password | length <= 0
|
|
|
|
- name: Create .ssh directory
|
|
ansible.builtin.file:
|
|
path: "/root/.ssh"
|
|
state: directory
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0700"
|
|
|
|
- name: "Create authorized_keys file"
|
|
ansible.builtin.template:
|
|
src: root/.ssh/authorized_keys.j2
|
|
dest: "/root/.ssh/authorized_keys"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0600"
|
|
when: root.ssh is defined and
|
|
root.ssh.authorized_keys is defined and
|
|
root.ssh.authorized_keys | length > 0
|
|
|
|
- name: "Remove authorized_keys file"
|
|
ansible.builtin.file:
|
|
path: "/root/.ssh/authorized_keys"
|
|
state: absent
|
|
when: root.ssh is defined and
|
|
root.ssh.authorized_keys is defined and
|
|
root.ssh.authorized_keys | length <= 0 or
|
|
root.ssh is defined and
|
|
root.ssh.authorized_keys is not defined or
|
|
root.ssh is not defined
|
|
|
|
- name: "Create private and public SSH key"
|
|
when: root.ssh is defined and
|
|
root.ssh.private_keys is defined and
|
|
root.ssh.private_keys | length > 0
|
|
block:
|
|
- name: "Create private SSH keys"
|
|
ansible.builtin.copy:
|
|
content: "{{ item.content }}"
|
|
dest: "/root/.ssh/{{ item.filename }}"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0600"
|
|
loop: "{{ root.ssh.private_keys }}"
|
|
loop_control:
|
|
label: "{{ item.filename }}"
|
|
|
|
- name: "Extract public SSH keys from private keys"
|
|
ansible.builtin.command:
|
|
argv: [ "ssh-keygen", "-y", "-f", "/root/.ssh/{{ item.filename }}" ]
|
|
register: _root_ssh_pub_key_extraction
|
|
changed_when: false
|
|
loop: "{{ root.ssh.private_keys }}"
|
|
loop_control:
|
|
label: "{{ item.filename }}"
|
|
|
|
- name: "Write derived public SSH keys"
|
|
ansible.builtin.copy:
|
|
content: "{{ item.stdout }}\n"
|
|
dest: "/root/.ssh/{{ item.item.filename }}.pub"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0644"
|
|
loop: "{{ _root_ssh_pub_key_extraction.results }}"
|
|
loop_control:
|
|
label: "{{ item.item.filename }}"
|
|
|
|
- name: "Create custom SSH client config"
|
|
ansible.builtin.template:
|
|
src: root/.ssh/config.j2
|
|
dest: /root/.ssh/config
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0644"
|
|
when: root.ssh.config is defined and root.ssh.config | length >= 0
|
|
|
|
- name: "Remove custom SSH client config"
|
|
ansible.builtin.file:
|
|
path: "/root/.ssh/config"
|
|
state: absent
|
|
when: root.ssh.config is not defined
|