4 files changed, 100 insertions, 0 deletions

diff --git a/roles/sshd/README b/roles/sshd/README
new file mode 100644
index 0000000..40ee00a
--- /dev/null
+++ b/roles/sshd/README
@@ -0,0 +1,6 @@
+This role, sshd, configures an SSH server on a Debian. Specifically
+may:
+
+- set host key and certificate
+- set user CA
+- set port on which server listens
diff --git a/roles/sshd/handlers/main.yml b/roles/sshd/handlers/main.yml
new file mode 100644
index 0000000..c4898c0
--- /dev/null
+++ b/roles/sshd/handlers/main.yml
@@ -0,0 +1,4 @@
+- name: sshd_restart
+  systemd:
+    name: ssh
+    state: restarted
diff --git a/roles/sshd/subplot.md b/roles/sshd/subplot.md
new file mode 100644
index 0000000..e86e513
--- /dev/null
+++ b/roles/sshd/subplot.md
@@ -0,0 +1,27 @@
+# Role `sshd` – configure an SSH server
+
+This role sets up a Debian system so that it can be managed with
+Ansible in a reasonable way.
+
+## Version history
+
+### Version 1
+
+First version. Supports `sshd_version`, `sshd_port`, `sshd_host_key`,
+`sshd_host_cert`, and `sshd_user_ca_pub`.
+
+# Configure SSH
+
+~~~scenario
+given a host running Debian
+when I use role sshd
+and I use variables from sshd.yml
+and I run the playbook
+then stdout contains "sshd role version"
+~~~
+
+~~~{#sshd.yml .file .yaml}
+ansible_python_interpreter: /usr/bin/python3
+
+sshd_version: 1
+~~~
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
new file mode 100644
index 0000000..f4c2104
--- /dev/null
+++ b/roles/sshd/tasks/main.yml
@@ -0,0 +1,63 @@
+- name: "sshd role version"
+  shell: |
+    [ "{{ sshd_version }}" = "1" ] || \
+      (echo "Unexpected version {{ sshd_version }}" 1>&2; exit 1)
+
+- name: "Set SSH host identity"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      {{ sshd_host_key }}
+    dest: /etc/ssh/ssh_host_key
+    owner: root
+    group: root
+    mode: 0600
+  notify: sshd_restart
+
+- name: "Set SSH host certificate"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      {{ sshd_host_cert }}
+    dest: /etc/ssh/ssh_host_key-cert.pub
+  notify: sshd_restart
+
+- name: "Configure SSH server host key"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      HostKeyAlgorithms ssh-ed25519
+      HostKey /etc/ssh/ssh_host_key
+      HostCertificate /etc/ssh/ssh_host_key-cert.pub
+    dest: /etc/ssh/sshd_config.d/host_id.conf
+  notify: sshd_restart
+
+- name: "Remove obsolete SSH host keys and certificates"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  shell: |
+    find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete
+  notify: sshd_restart
+
+- name: "Configure SSH server port"
+  when: sshd_port is defined
+  copy:
+    content: |
+      Port {{ sshd_port }}
+    dest: /etc/ssh/sshd_config.d/port.conf
+  notify: sshd_restart
+
+- name: "Configure user CA for SSH server"
+  when: sshd_user_ca_pub is defined
+  copy:
+    content: |
+      {{ sshd_user_ca_pub }}
+    dest: /etc/ssh/user_ca_pubs
+  notify: sshd_restart
+
+- name: "Configure SSH server to accept user CA"
+  when: sshd_user_ca_pub is defined
+  copy:
+    content: |
+      TrustedUserCAKeys /etc/ssh/user_ca_pubs
+    dest: /etc/ssh/sshd_config.d/user_ca.conf
+  notify: sshd_restart