mrcharles
88e3f40331
ci / audit (push) Successful in 46s
Idempotent role: install fleet User CA public key + TrustedUserCAKeys drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR. https://projects.knownelement.com/issues/385
26 lines
696 B
YAML
26 lines
696 B
YAML
---
|
|
# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
|
|
# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
|
|
# Private CA keys NEVER come from the control node.
|
|
- name: install fleet user CA public key
|
|
ansible.builtin.copy:
|
|
src: "{{ ssh_ca_key_src }}"
|
|
dest: "{{ ssh_ca_key_dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: reload sshd
|
|
|
|
- name: install TrustedUserCAKeys drop-in
|
|
ansible.builtin.copy:
|
|
dest: "{{ ssh_ca_dropin }}"
|
|
content: "{{ ssh_ca_trusted_line }}\n"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: reload sshd
|
|
|
|
- name: validate sshd config
|
|
ansible.builtin.command: sshd -t
|
|
changed_when: false
|