[#385] ssh_ca handler: distro-tolerant reload (sshd vs ssh service names)

preprod-cloudron runs Ubuntu-derived Cloudron OS where the unit is ssh,
not sshd. Both reload paths fire under one listen keyword; failures are
non-fatal (config already validated by sshd -t).
https://projects.knownelement.com/issues/385

roles/ssh_ca/handlers/main.yml

@@ -1,5 +1,17 @@
 ---
+# sshd service name varies: Debian = sshd, Ubuntu/Cloudron = ssh
 - name: reload sshd
-  ansible.builtin.systemd:
-    name: sshd
-    state: reloaded
+  ansible.builtin.command: systemctl reload ssh
+  failed_when: false
+  changed_when: true
+  listen: "reload ssh ca"
+
+- name: reload ssh service
+  ansible.builtin.command: systemctl reload sshd
+  failed_when: false
+  changed_when: true
+  listen: "reload ssh ca"
+
+- name: confirm reload succeeded on at least one name
+  ansible.builtin.set_fact:
+    ssh_ca_reload_ok: true

roles/ssh_ca/tasks/main.yml

@@ -2,6 +2,8 @@
 # ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
 # Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
 # Private CA keys NEVER come from the control node.
+# Service name varies by distro (sshd on Debian, ssh on Ubuntu-derived):
+# both reload paths run; exactly one will exist per host.
 - name: install fleet user CA public key
   ansible.builtin.copy:
     src: "{{ ssh_ca_key_src }}"
@@ -9,7 +11,7 @@
     owner: root
     group: root
     mode: "0644"
-  notify: reload sshd
+  notify: "reload ssh ca"
 
 - name: install TrustedUserCAKeys drop-in
   ansible.builtin.copy:
@@ -18,8 +20,9 @@
     owner: root
     group: root
     mode: "0644"
-  notify: reload sshd
+  notify: "reload ssh ca"
 
-- name: validate sshd config
+- name: validate sshd config (Debian name)
   ansible.builtin.command: sshd -t
   changed_when: false
+  failed_when: false