[#385] ssh_ca role + onboarding playbook (fleet SSH cert CA rollout)

Idempotent role: install fleet User CA public key + TrustedUserCAKeys drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR. https://projects.knownelement.com/issues/385
2026-09-05 17:11:12 -05:00
parent 3815aee578
commit 88e3f40331
6 changed files with 53 additions and 1 deletions
@@ -0,0 +1,25 @@
+---
+# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
+# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
+# Private CA keys NEVER come from the control node.
+- name: install fleet user CA public key
+  ansible.builtin.copy:
+    src: "{{ ssh_ca_key_src }}"
+    dest: "{{ ssh_ca_key_dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: install TrustedUserCAKeys drop-in
+  ansible.builtin.copy:
+    dest: "{{ ssh_ca_dropin }}"
+    content: "{{ ssh_ca_trusted_line }}\n"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: validate sshd config
+  ansible.builtin.command: sshd -t
+  changed_when: false