fix(ssh): refresh public keys after key rotation

Recompute public keys from the configured private keys so existing public key files cannot become stale.
Use copy to preserve idempotence, ownership and permissions.

Co-authored-by: Copilot <copilot@github.com>

tasks/create_unix_user.yml

@@ -108,25 +108,26 @@
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
 - name: "Extract public SSH keys from private keys for unix user: {{ unix_user.key }}"
-  ansible.builtin.shell:
+  ansible.builtin.command:
-    cmd: "ssh-keygen -y -f {{ (_unix_users_home + '/.ssh/' + item.filename) | quote }} > {{ (_unix_users_home + '/.ssh/' + item.filename + '.pub') | quote }}"
+    argv: [ "ssh-keygen", "-y", "-f", "{{ _unix_users_home }}/.ssh/{{ item.filename }}" ]
-    creates: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
+  changed_when: false
+  register: _unix_users_ssh_pub_key_extraction
   loop_control:
     label: "{{ item.filename }}"
   with_items:
   - "{{ unix_user.value.ssh.private_keys }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
-- name: "Correct permissions of public SSH keys for unix user: {{ unix_user.key }}"
+- name: "Write derived public SSH keys for unix user: {{ unix_user.key }}"
-  ansible.builtin.file:
+  ansible.builtin.copy:
-    path: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
+    content: "{{ item.stdout }}\n"
+    dest: "{{ _unix_users_home }}/.ssh/{{ item.item.filename }}.pub"
     owner: "{{ unix_user.key }}"
     group: "{{ unix_user.value.group | default('users') }}"
     mode: "0644"
   loop_control:
-    label: "{{ item.filename }}"
+    label: "{{ item.item.filename }}"
-  with_items:
+  loop: "{{ _unix_users_ssh_pub_key_extraction.results }}"
-  - "{{ unix_user.value.ssh.private_keys }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
 - name: "Create custom SSH client config for unix user: {{ unix_user.key }}"