mrcharles
e9003721e3
ci / audit (push) Successful in 46s
preprod-cloudron runs Ubuntu-derived Cloudron OS where the unit is ssh, not sshd. Both reload paths fire under one listen keyword; failures are non-fatal (config already validated by sshd -t). https://projects.knownelement.com/issues/385
29 lines
870 B
YAML
29 lines
870 B
YAML
---
|
|
# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
|
|
# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
|
|
# Private CA keys NEVER come from the control node.
|
|
# Service name varies by distro (sshd on Debian, ssh on Ubuntu-derived):
|
|
# both reload paths run; exactly one will exist per host.
|
|
- name: install fleet user CA public key
|
|
ansible.builtin.copy:
|
|
src: "{{ ssh_ca_key_src }}"
|
|
dest: "{{ ssh_ca_key_dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: "reload ssh ca"
|
|
|
|
- name: install TrustedUserCAKeys drop-in
|
|
ansible.builtin.copy:
|
|
dest: "{{ ssh_ca_dropin }}"
|
|
content: "{{ ssh_ca_trusted_line }}\n"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: "reload ssh ca"
|
|
|
|
- name: validate sshd config (Debian name)
|
|
ansible.builtin.command: sshd -t
|
|
changed_when: false
|
|
failed_when: false
|