feat(ssh)!: configure keys with filename and content
Lint Markdown files / markdown-lint (push) Successful in 7s
Ansible Linter / ansible-lint (push) Successful in 2m15s
Molecule / Molecule (push) Successful in 5m45s
Release Ansible Role / Release Ansible Role (push) Successful in 1m35s

Accept SSH key content directly so callers no longer need role-specific
source directories. Update Molecule coverage and documentation.

BREAKING CHANGE: private_keys entries must be objects with filename and
content instead of file names. authorized_keys entries must provide
content alongside filename. Public keys are also written to ~/.ssh.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschekandCopilot committed 2026-10-17 21:41:41 +02:00
1 parent 6d42e7cc41
commit de280ef620
6 files changed
+87 -32

No files matched your search

+11 -4
View File
@@ -138,10 +138,11 @@ environment variables can be espcilitly defined, to consume it during execution
> [!IMPORTANT]
> To allow consuming environment variables must be set `PermitUserEnvironment yes` in `/etc/ssh/sshd_config`.
The private key `toor@toor-pc.ed25519.key` must be stored in `ssh/private_keys`. The public key will be automatically
extracted from the private key.
Private and public keys are configured directly using `filename` and `content`. The role writes each key to
`~/.ssh/<filename>`. Store private key content encrypted with Ansible Vault.
The public keys `claire@claire-pc.pub` as well as `bob@bob-pc.pub` must be stored in `ssh/authorized_keys`.
Entries in `authorized_keys` are also added to `~/.ssh/authorized_keys`, including their optional command and environment
settings. Public keys are still automatically extracted from private keys into `~/.ssh/<filename>.pub`.
```yaml
unix_users:
@@ -157,13 +158,19 @@ unix_users:
UserKnownHostFile: /dev/null
authorized_keys:
- filename: claire@claire-pc.pub
content: ssh-ed25519 AAAAC3NzaC... claire
- command: /usr/local/bin/upload-file.sh
envs:
- key: SSH_KEY_NAME
value: bob@bob-pc
filename: bob@bob-pc.pub
content: ssh-ed25519 AAAAC3NzaC... bob
private_keys:
- toor@toor-pc.ed25519.key
- filename: toor@toor-pc.ed25519.key
content: |
-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----
shell: /bin/bash
password: toor
group: toor