- hosts: ssh-dev
  remote_user: debian
  become: yes
  roles:
    - role: sane_debian_system
    - role: unix_users
  tasks:
    - name: "Set SSH host identity"
      when: sshd_host_key is defined and sshd_host_cert is defined
      copy:
        content: |
          {{ sshd_host_key }}
        dest: /etc/ssh/ssh_host_key
        owner: root
        group: root
        mode: 0600
      notify: sshd_restart

    - name: "Set SSH host certificate"
      when: sshd_host_key is defined and sshd_host_cert is defined
      copy:
        content: |
          {{ sshd_host_cert }}
        dest: /etc/ssh/ssh_host_key-cert.pub
      notify: sshd_restart

    - name: "Configure SSH server host key"
      when: sshd_host_key is defined and sshd_host_cert is defined
      copy:
        content: |
          HostKeyAlgorithms ssh-ed25519
          HostKey /etc/ssh/ssh_host_key
          HostCertificate /etc/ssh/ssh_host_key-cert.pub
        dest: /etc/ssh/sshd_config.d/host_id.conf
      notify: sshd_restart

    - name: "Remove obsolete SSH host keys and certificates"
      when: sshd_host_key is defined and sshd_host_cert is defined
      shell: |
        find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete
      notify: sshd_restart

    - name: "Configure SSH server port"
      when: sshd_port is defined
      copy:
        content: |
          Port {{ sshd_port }}
        dest: /etc/ssh/sshd_config.d/port.conf
      notify: sshd_restart

    - name: "Configure user CA for SSH server"
      when: sshd_user_ca_pub is defined
      copy:
        content: |
          {{ sshd_user_ca_pub }}
        dest: /etc/ssh/user_ca_pubs
      notify: sshd_restart

    - name: "Configure SSH server to accept user CA"
      when: sshd_user_ca_pub is defined
      copy:
        content: |
          TrustedUserCAKeys /etc/ssh/user_ca_pubs
        dest: /etc/ssh/sshd_config.d/user_ca.conf
      notify: sshd_restart

  handlers:
    - name: sshd_restart
      systemd:
        name: ssh
        state: restarted
  vars:
    ansible_python_interpreter: /usr/bin/python3

    sane_debian_system_version: 2
    sane_debian_system_hostname: "{{ inventory_hostname }}"
    sane_debian_system_codename: bullseye
    sane_debian_system_mirror: deb.debian.org

    unix_users_version: 2
    unix_users:
      - username: liw

    sshd_port: 22
    sshd_user_ca_pub: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHdSnGI91exKItWsZi0XFVQWluS0FUdd12FLjuQk1FxG liw User CA v1

    sshd_host_key: |
      -----BEGIN OPENSSH PRIVATE KEY-----
      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
      QyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuAAAAJD/iISQ/4iE
      kAAAAAtzc2gtZWQyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuA
      AAAEAsqoHFGyZZzwgNSfofP9NAwwMJMaKltYXkwBMfONIZ1vj3Fh2aN9WnR3KWIe8syz69
      mc8VVnjnLI+9YBVV4eG4AAAACmxpd0Bzb2xhY2UBAgM=
      -----END OPENSSH PRIVATE KEY-----
    sshd_host_cert: ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIEJUVm2WJkZ0r+KFXpk2RHb7qMZHTKUwLdTyxb9AuREpAAAAIPj3Fh2aN9WnR3KWIe8syz69mc8VVnjnLI+9YBVV4eG4AAAAAAAAAAAAAAACAAAAIGhvc3QgY2VydGlmaWNhdGUgZm9yIC1udGVzdCBvbmx5AAAACAAAAAR0ZXN0AAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgvfQa9RoKfpcBZturxQz5/vrj0Gc76JzMW0rOKmYK90gAAABTAAAAC3NzaC1lZDI1NTE5AAAAQM5t7a4I4/IQPimHYXcj64iiAcCqzTSJcoQBrUwrTspGi5O1/3ibmbShwZJihmcYpCpFMTmA2nvO5+cqguSIlAo= liw@solace