---
# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
# Private CA keys NEVER come from the control node.
- name: install fleet user CA public key
  ansible.builtin.copy:
    src: "{{ ssh_ca_key_src }}"
    dest: "{{ ssh_ca_key_dest }}"
    owner: root
    group: root
    mode: "0644"
  notify: reload sshd

- name: install TrustedUserCAKeys drop-in
  ansible.builtin.copy:
    dest: "{{ ssh_ca_dropin }}"
    content: "{{ ssh_ca_trusted_line }}\n"
    owner: root
    group: root
    mode: "0644"
  notify: reload sshd

- name: validate sshd config
  ansible.builtin.command: sshd -t
  changed_when: false