1 files changed, 63 insertions, 0 deletions
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
new file mode 100644
index 0000000..f4c2104
--- /dev/null
+++ b/roles/sshd/tasks/main.yml
@@ -0,0 +1,63 @@
+- name: "sshd role version"
+  shell: |
+    [ "{{ sshd_version }}" = "1" ] || \
+      (echo "Unexpected version {{ sshd_version }}" 1>&2; exit 1)
+
+- name: "Set SSH host identity"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      {{ sshd_host_key }}
+    dest: /etc/ssh/ssh_host_key
+    owner: root
+    group: root
+    mode: 0600
+  notify: sshd_restart
+
+- name: "Set SSH host certificate"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      {{ sshd_host_cert }}
+    dest: /etc/ssh/ssh_host_key-cert.pub
+  notify: sshd_restart
+
+- name: "Configure SSH server host key"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      HostKeyAlgorithms ssh-ed25519
+      HostKey /etc/ssh/ssh_host_key
+      HostCertificate /etc/ssh/ssh_host_key-cert.pub
+    dest: /etc/ssh/sshd_config.d/host_id.conf
+  notify: sshd_restart
+
+- name: "Remove obsolete SSH host keys and certificates"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  shell: |
+    find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete
+  notify: sshd_restart
+
+- name: "Configure SSH server port"
+  when: sshd_port is defined
+  copy:
+    content: |
+      Port {{ sshd_port }}
+    dest: /etc/ssh/sshd_config.d/port.conf
+  notify: sshd_restart
+
+- name: "Configure user CA for SSH server"
+  when: sshd_user_ca_pub is defined
+  copy:
+    content: |
+      {{ sshd_user_ca_pub }}
+    dest: /etc/ssh/user_ca_pubs
+  notify: sshd_restart
+
+- name: "Configure SSH server to accept user CA"
+  when: sshd_user_ca_pub is defined
+  copy:
+    content: |
+      TrustedUserCAKeys /etc/ssh/user_ca_pubs
+    dest: /etc/ssh/sshd_config.d/user_ca.conf
+  notify: sshd_restart