From 88e3f403314baeab745f61f5ddad61f6fcbd6d19 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Sat, 5 Sep 2026 17:11:12 -0500
Subject: [PATCH] [#385] ssh_ca role + onboarding playbook (fleet SSH cert CA
 rollout)

Idempotent role: install fleet User CA public key + TrustedUserCAKeys
drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR.
https://projects.knownelement.com/issues/385
---
 .crush/active-ticket                 |  2 +-
 playbooks/ssh_ca_onboard.yml         |  8 ++++++++
 roles/ssh_ca/defaults/main.yml       |  6 ++++++
 roles/ssh_ca/files/fleet_user_ca.pub |  1 +
 roles/ssh_ca/meta/main.yml           | 12 ++++++++++++
 roles/ssh_ca/tasks/main.yml          | 25 +++++++++++++++++++++++++
 6 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 playbooks/ssh_ca_onboard.yml
 create mode 100644 roles/ssh_ca/defaults/main.yml
 create mode 100644 roles/ssh_ca/files/fleet_user_ca.pub
 create mode 100644 roles/ssh_ca/meta/main.yml
 create mode 100644 roles/ssh_ca/tasks/main.yml

diff --git a/.crush/active-ticket b/.crush/active-ticket
index f4462de..a5941da 100644
--- a/.crush/active-ticket
+++ b/.crush/active-ticket
@@ -1 +1 @@
-#454
+#385
diff --git a/playbooks/ssh_ca_onboard.yml b/playbooks/ssh_ca_onboard.yml
new file mode 100644
index 0000000..87a510b
--- /dev/null
+++ b/playbooks/ssh_ca_onboard.yml
@@ -0,0 +1,8 @@
+---
+# ssh_ca_onboard.yml — fleet SSH certificate CA rollout [#385]
+# Targets: sectestbed wave first (compliance lab #379), then prod under CR.
+- name: Onboard hosts to the fleet SSH certificate CA
+  hosts: all
+  gather_facts: false
+  roles:
+    - ssh_ca
diff --git a/roles/ssh_ca/defaults/main.yml b/roles/ssh_ca/defaults/main.yml
new file mode 100644
index 0000000..840d4eb
--- /dev/null
+++ b/roles/ssh_ca/defaults/main.yml
@@ -0,0 +1,6 @@
+---
+# ssh_ca role defaults [#385]
+ssh_ca_key_src: fleet_user_ca.pub          # role file (public key only)
+ssh_ca_key_dest: /etc/ssh/fleet_user_ca.pub
+ssh_ca_dropin: /etc/ssh/sshd_config.d/99-fleet-ca.conf
+ssh_ca_trusted_line: "TrustedUserCAKeys /etc/ssh/fleet_user_ca.pub"
diff --git a/roles/ssh_ca/files/fleet_user_ca.pub b/roles/ssh_ca/files/fleet_user_ca.pub
new file mode 100644
index 0000000..7c52bfe
--- /dev/null
+++ b/roles/ssh_ca/files/fleet_user_ca.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHtlhPfNlm/6bJqPRQv7jsrt1sMUTKgAAwUh0yZCESNU KNEL Fleet SSH User CA
diff --git a/roles/ssh_ca/meta/main.yml b/roles/ssh_ca/meta/main.yml
new file mode 100644
index 0000000..3baf6f5
--- /dev/null
+++ b/roles/ssh_ca/meta/main.yml
@@ -0,0 +1,12 @@
+---
+galaxy_info:
+  author: KNEL OAM lane
+  description: Onboard host to the fleet SSH certificate CA (TrustedUserCAKeys)
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.14"
+  platforms:
+    - name: Debian
+      versions: [bookworm, trixie]
+    - name: Ubuntu
+      versions: [noble]
+dependencies: []
diff --git a/roles/ssh_ca/tasks/main.yml b/roles/ssh_ca/tasks/main.yml
new file mode 100644
index 0000000..4e3c123
--- /dev/null
+++ b/roles/ssh_ca/tasks/main.yml
@@ -0,0 +1,25 @@
+---
+# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
+# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
+# Private CA keys NEVER come from the control node.
+- name: install fleet user CA public key
+  ansible.builtin.copy:
+    src: "{{ ssh_ca_key_src }}"
+    dest: "{{ ssh_ca_key_dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: install TrustedUserCAKeys drop-in
+  ansible.builtin.copy:
+    dest: "{{ ssh_ca_dropin }}"
+    content: "{{ ssh_ca_trusted_line }}\n"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: validate sshd config
+  ansible.builtin.command: sshd -t
+  changed_when: false