fix(defaults): disable alice

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -138,11 +138,11 @@ environment variables can be espcilitly defined, to consume it during execution
 > [!IMPORTANT]
 > To allow consuming environment variables must be set `PermitUserEnvironment yes` in `/etc/ssh/sshd_config`.
 
-Private and public keys are configured directly using `filename` and `content`. The role writes each key to
-`~/.ssh/<filename>`. Store private key content encrypted with Ansible Vault.
+Private keys are configured using `filename` and `content`; the role writes them to `~/.ssh/<filename>` and extracts
+their public keys to `~/.ssh/<filename>.pub`. Store private key content encrypted with Ansible Vault.
 
 Entries in `authorized_keys` are also added to `~/.ssh/authorized_keys`, including their optional command and environment
-settings. Public keys are still automatically extracted from private keys into `~/.ssh/<filename>.pub`.
+settings.
 
 ```yaml
 unix_users:
@@ -157,13 +157,11 @@ unix_users:
         StrictHostKeyChecking: "no"
         UserKnownHostFile: /dev/null
       authorized_keys:
-      - filename: claire@claire-pc.pub
-        content: ssh-ed25519 AAAAC3NzaC... claire
+      - content: ssh-ed25519 AAAAC3NzaC... claire
       - command: /usr/local/bin/upload-file.sh
         envs:
         - key: SSH_KEY_NAME
           value: bob@bob-pc
-        filename: bob@bob-pc.pub
         content: ssh-ed25519 AAAAC3NzaC... bob
       private_keys:
       - filename: toor@toor-pc.ed25519.key

defaults/main.yml

@@ -8,26 +8,25 @@ unix_groups: {}
 #     gid: 1001
 #     state: absent
 
-unix_users:
-  alice:
-    state: "present"
-    name: "Alice"
-    uid: "1000"
-    ssh:
-      config:
-      - Host: "*"
-        StrictHostKeyChecking: "no"
-        UserKnownHostFile: /dev/null
-      authorized_keys:
-      - filename: alice@alice-pc.pub
-        content: ssh-ed25519 AAAAC3NzaC... alice
-        # command: "" # optional
-      private_keys:
-      - filename: alice@alice-pc.ed25519.key
-        content: |
-          -----BEGIN OPENSSH PRIVATE KEY-----
-          ...
-          -----END OPENSSH PRIVATE KEY-----
+unix_users: {}
+# alice:
+#   state: "present"
+#   name: "Alice"
+#   uid: "1000"
+#   ssh:
+#     config:
+#     - Host: "*"
+#       StrictHostKeyChecking: "no"
+#       UserKnownHostFile: /dev/null
+#     authorized_keys:
+#     - content: ssh-ed25519 AAAAC3NzaC... alice
+#       # command: "" # optional
+#     private_keys:
+#     - filename: alice@alice-pc.ed25519.key
+#       content: |
+#         -----BEGIN OPENSSH PRIVATE KEY-----
+#         ...
+#         -----END OPENSSH PRIVATE KEY-----
 #     home: /home/alice
 #     btrfs: false
 #     netrc:

molecule/default/converge.yml

@@ -28,14 +28,12 @@
           - Host: "*"
             StrictHostKeyChecking: "no"
           authorized_keys:
-          - filename: alice.pub
-            content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}"
+          - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}"
             command: "/usr/bin/true"
             envs:
             - key: EDITOR
               value: vi
-          - filename: alice-login.pub
-            content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}"
+          - content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}"
           private_keys:
           - filename: alice.ed25519.key
             content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/private_keys/molecule.ed25519.key', rstrip=false) }}"

molecule/default/verify.yml

@@ -11,8 +11,6 @@
       /home/molecule-alice/.ssh/config: "0644"
       /home/molecule-alice/.ssh/alice.ed25519.key: "0600"
       /home/molecule-alice/.ssh/alice.ed25519.key.pub: "0644"
-      /home/molecule-alice/.ssh/alice.pub: "0644"
-      /home/molecule-alice/.ssh/alice-login.pub: "0644"
       /home/molecule-alice/.forward: "0644"
       /home/molecule-alice/.netrc: "0600"
       /home/molecule-alice/.bashrc.d: "0755"
@@ -88,28 +86,6 @@
       - (_alice_keys.results[0].content | b64decode).splitlines() | select('match', '^ssh-ed25519 ') | list | length == 1
       fail_msg: "the authorized key of molecule-alice does not match the key extracted from its private key"
 
-  - name: Read the configured private and public SSH key files
-    ansible.builtin.slurp:
-      src: "{{ _alice_home }}/.ssh/{{ item }}"
-    loop:
-    - alice.ed25519.key
-    - alice.pub
-    - alice-login.pub
-    no_log: true
-    register: _alice_key_contents
-
-  - name: Assert that SSH key files contain the exact configured content
-    vars:
-      _private_key_content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/private_keys/molecule.ed25519.key', rstrip=false) }}"
-      _public_key_content: "{{ lookup('ansible.builtin.file', molecule_scenario_directory + '/files/ssh/authorized_keys/molecule.pub', rstrip=false) }}"
-    ansible.builtin.assert:
-      that:
-      - (_alice_key_contents.results[0].content | b64decode) == _private_key_content
-      - (_alice_key_contents.results[1].content | b64decode) == _public_key_content
-      - (_alice_key_contents.results[2].content | b64decode) == _public_key_content
-      - _public_key_content | trim in (_alice_keys.results[0].content | b64decode).splitlines()
-    no_log: true
-
   - name: Read the user and group database
     ansible.builtin.getent:
       database: "{{ item }}"

tasks/create_unix_user.yml

@@ -95,17 +95,6 @@
     state: absent
   when: unix_user.value.ssh.authorized_keys is not defined or unix_user.value.ssh.authorized_keys | length <= 0
 
-- name: "Create public SSH keys for unix user: {{ unix_user.key }}"
-  ansible.builtin.copy:
-    content: "{{ item.content }}"
-    dest: "{{ _unix_users_home }}/.ssh/{{ item.filename }}"
-    owner: "{{ unix_user.key }}"
-    group: "{{ unix_user.value.group | default('users') }}"
-    mode: "0644"
-  loop: "{{ unix_user.value.ssh.authorized_keys | default([]) }}"
-  loop_control:
-    label: "{{ item.filename }}"
-
 - name: "Create private SSH keys for unix user: {{ unix_user.key }}"
   ansible.builtin.copy:
     content: "{{ item.content }}"