---
# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
# Private CA keys NEVER come from the control node.
# Service name varies by distro (sshd on Debian, ssh on Ubuntu-derived):
# both reload paths run; exactly one will exist per host.
- name: install fleet user CA public key
  ansible.builtin.copy:
    src: "{{ ssh_ca_key_src }}"
    dest: "{{ ssh_ca_key_dest }}"
    owner: root
    group: root
    mode: "0644"
  notify: "reload ssh ca"

- name: install TrustedUserCAKeys drop-in
  ansible.builtin.copy:
    dest: "{{ ssh_ca_dropin }}"
    content: "{{ ssh_ca_trusted_line }}\n"
    owner: root
    group: root
    mode: "0644"
  notify: "reload ssh ca"

- name: validate sshd config (Debian name)
  ansible.builtin.command: sshd -t
  changed_when: false
  failed_when: false