From 7683306d5fa5ef3de056759cbccda0c531c6e4fe Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Sun, 18 Oct 2026 15:10:40 +0200
Subject: [PATCH] fix(ssh): refresh public keys after key rotation

Recompute public keys from the configured private keys so existing public key files cannot become stale.
Use copy to preserve idempotence, ownership and permissions.

Co-authored-by: Copilot <copilot@github.com>
---
 tasks/create_unix_user.yml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/tasks/create_unix_user.yml b/tasks/create_unix_user.yml
index fbab9a4..bb90345 100644
--- a/tasks/create_unix_user.yml
+++ b/tasks/create_unix_user.yml
@@ -108,25 +108,26 @@
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
 - name: "Extract public SSH keys from private keys for unix user: {{ unix_user.key }}"
-  ansible.builtin.shell:
-    cmd: "ssh-keygen -y -f {{ (_unix_users_home + '/.ssh/' + item.filename) | quote }} > {{ (_unix_users_home + '/.ssh/' + item.filename + '.pub') | quote }}"
-    creates: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
+  ansible.builtin.command:
+    argv: [ "ssh-keygen", "-y", "-f", "{{ _unix_users_home }}/.ssh/{{ item.filename }}" ]
+  changed_when: false
+  register: _unix_users_ssh_pub_key_extraction
   loop_control:
     label: "{{ item.filename }}"
   with_items:
   - "{{ unix_user.value.ssh.private_keys }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
-- name: "Correct permissions of public SSH keys for unix user: {{ unix_user.key }}"
-  ansible.builtin.file:
-    path: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
+- name: "Write derived public SSH keys for unix user: {{ unix_user.key }}"
+  ansible.builtin.copy:
+    content: "{{ item.stdout }}\n"
+    dest: "{{ _unix_users_home }}/.ssh/{{ item.item.filename }}.pub"
     owner: "{{ unix_user.key }}"
     group: "{{ unix_user.value.group | default('users') }}"
     mode: "0644"
   loop_control:
-    label: "{{ item.filename }}"
-  with_items:
-  - "{{ unix_user.value.ssh.private_keys }}"
+    label: "{{ item.item.filename }}"
+  loop: "{{ _unix_users_ssh_pub_key_extraction.results }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
 - name: "Create custom SSH client config for unix user: {{ unix_user.key }}"