fix(defaults): disable alice

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/ansible-linters.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Run ansible-lint
-      uses: ansible/ansible-lint@e7f397ad6dfa20d274afa17cd7bbedd84ed136f5 # v26.9.0
+      uses: ansible/ansible-lint@9bce2bfb8f4a984e6b13767bc0d6bf0a49492164 # v26.10.1
       with:
         args: "--config-file .ansible-lint"
         # The molecule scenario is linted as well, so its collections are required beside the ones of the role.

README.md

@@ -138,10 +138,11 @@ environment variables can be espcilitly defined, to consume it during execution
 > [!IMPORTANT]
 > To allow consuming environment variables must be set `PermitUserEnvironment yes` in `/etc/ssh/sshd_config`.
 
-The private key `toor@toor-pc.ed25519.key` must be stored in `ssh/private_keys`. The public key will be automatically
-extracted from the private key.
+Private keys are configured using `filename` and `content`; the role writes them to `~/.ssh/<filename>` and extracts
+their public keys to `~/.ssh/<filename>.pub`. Store private key content encrypted with Ansible Vault.
 
-The public keys `claire@claire-pc.pub` as well as `bob@bob-pc.pub` must be stored in `ssh/authorized_keys`.
+Entries in `authorized_keys` are also added to `~/.ssh/authorized_keys`, including their optional command and environment
+settings.
 
 ```yaml
 unix_users:
@@ -156,14 +157,18 @@ unix_users:
         StrictHostKeyChecking: "no"
         UserKnownHostFile: /dev/null
       authorized_keys:
-      - filename: claire@claire-pc.pub
+      - content: ssh-ed25519 AAAAC3NzaC... claire
       - command: /usr/local/bin/upload-file.sh
         envs:
         - key: SSH_KEY_NAME
           value: bob@bob-pc
-        filename: bob@bob-pc.pub
+        content: ssh-ed25519 AAAAC3NzaC... bob
       private_keys:
-      - toor@toor-pc.ed25519.key
+      - filename: toor@toor-pc.ed25519.key
+        content: |
+          -----BEGIN OPENSSH PRIVATE KEY-----
+          ...
+          -----END OPENSSH PRIVATE KEY-----
     shell: /bin/bash
     password: toor
     group: toor

defaults/main.yml

@@ -19,10 +19,14 @@ unix_users: {}
 #       StrictHostKeyChecking: "no"
 #       UserKnownHostFile: /dev/null
 #     authorized_keys:
-#       - filename: alice@alice-pc.pub
+#     - content: ssh-ed25519 AAAAC3NzaC... alice
 #       # command: "" # optional
 #     private_keys:
-#       - alice@alice-pc.ed25519.key
+#     - filename: alice@alice-pc.ed25519.key
+#       content: |
+#         -----BEGIN OPENSSH PRIVATE KEY-----
+#         ...
+#         -----END OPENSSH PRIVATE KEY-----
 #     home: /home/alice
 #     btrfs: false
 #     netrc:

molecule/default/converge.yml

@@ -28,13 +28,15 @@
           - Host: "*"
             StrictHostKeyChecking: "no"
           authorized_keys:
-          - filename: molecule.pub
+          - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}"
             command: "/usr/bin/true"
             envs:
             - key: EDITOR
               value: vi
+          - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}"
           private_keys:
-          - molecule.ed25519.key
+          - filename: alice.ed25519.key
+            content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/private_keys/molecule.ed25519.key', rstrip=false) }}"
         netrc:
         - machine: hostname.local
           login: alice

molecule/default/verify.yml

@@ -9,8 +9,8 @@
       /home/molecule-alice/.ssh: "0700"
       /home/molecule-alice/.ssh/authorized_keys: "0600"
       /home/molecule-alice/.ssh/config: "0644"
-      /home/molecule-alice/.ssh/molecule.ed25519.key: "0600"
-      /home/molecule-alice/.ssh/molecule.ed25519.key.pub: "0644"
+      /home/molecule-alice/.ssh/alice.ed25519.key: "0600"
+      /home/molecule-alice/.ssh/alice.ed25519.key.pub: "0644"
       /home/molecule-alice/.forward: "0644"
       /home/molecule-alice/.netrc: "0600"
       /home/molecule-alice/.bashrc.d: "0755"
@@ -72,7 +72,7 @@
     register: _alice_keys
     loop:
     - "{{ _alice_home }}/.ssh/authorized_keys"
-    - "{{ _alice_home }}/.ssh/molecule.ed25519.key.pub"
+    - "{{ _alice_home }}/.ssh/alice.ed25519.key.pub"
 
   - name: Assert that the authorized key carries its options and matches the extracted public key
     vars:
@@ -83,6 +83,7 @@
       - _authorized_key.startswith('command="/usr/bin/true",environment="EDITOR=vi" ')
       - _public_key.startswith('ssh-ed25519 ')
       - _public_key.split()[1] == _authorized_key.split()[2]
+      - (_alice_keys.results[0].content | b64decode).splitlines() | select('match', '^ssh-ed25519 ') | list | length == 1
       fail_msg: "the authorized key of molecule-alice does not match the key extracted from its private key"
 
   - name: Read the user and group database

tasks/create_unix_user.yml

@@ -95,11 +95,10 @@
     state: absent
   when: unix_user.value.ssh.authorized_keys is not defined or unix_user.value.ssh.authorized_keys | length <= 0
 
-# The relative source is resolved against the files directory of the playbook, like the lookup in authorized_keys.j2.
 - name: "Create private SSH keys for unix user: {{ unix_user.key }}"
   ansible.builtin.copy:
-    src: "ssh/private_keys/{{ item }}"
-    dest: "{{ _unix_users_home }}/.ssh/{{ item }}"
+    content: "{{ item.content }}"
+    dest: "{{ _unix_users_home }}/.ssh/{{ item.filename }}"
     owner: "{{ unix_user.key }}"
     group: "{{ unix_user.value.group | default('users') }}"
     mode: "0600"
@@ -110,18 +109,22 @@
 
 - name: "Extract public SSH keys from private keys for unix user: {{ unix_user.key }}"
   ansible.builtin.shell:
-    cmd: "ssh-keygen -y -f {{ _unix_users_home }}/.ssh/{{ item }} > {{ _unix_users_home }}/.ssh/{{ item }}.pub"
-    creates: "{{ _unix_users_home }}/.ssh/{{ item }}.pub"
+    cmd: "ssh-keygen -y -f {{ (_unix_users_home + '/.ssh/' + item.filename) | quote }} > {{ (_unix_users_home + '/.ssh/' + item.filename + '.pub') | quote }}"
+    creates: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
+  loop_control:
+    label: "{{ item.filename }}"
   with_items:
   - "{{ unix_user.value.ssh.private_keys }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0
 
 - name: "Correct permissions of public SSH keys for unix user: {{ unix_user.key }}"
   ansible.builtin.file:
-    path: "{{ _unix_users_home }}/.ssh/{{ item }}.pub"
+    path: "{{ _unix_users_home }}/.ssh/{{ item.filename }}.pub"
     owner: "{{ unix_user.key }}"
     group: "{{ unix_user.value.group | default('users') }}"
     mode: "0644"
+  loop_control:
+    label: "{{ item.filename }}"
   with_items:
   - "{{ unix_user.value.ssh.private_keys }}"
   when: unix_user.value.ssh.private_keys is defined and unix_user.value.ssh.private_keys | length > 0

templates/authorized_keys.j2

@@ -21,8 +21,8 @@
     {% endif %}
   {% endif %}
   {% if _args | length > 0 %}
-{{ _args | join(',') }} {{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+{{ _args | join(',') }} {{ authorized_key.content | trim }}
   {% else %}
-{{ lookup('file', 'ssh/authorized_keys/' + authorized_key.filename ) }}
+{{ authorized_key.content | trim }}
   {% endif %}
 {% endfor %}