From 66e7ecebce239a3c59696786fb776f5d729831b1 Mon Sep 17 00:00:00 2001
From: Lars Wirzenius <liw@liw.fi>
Date: Sun, 31 Jul 2022 17:50:37 +0300
Subject: sshd: add

Sponsored-by: author
---
 roles/sshd/tasks/main.yml | 63 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 roles/sshd/tasks/main.yml

(limited to 'roles/sshd/tasks/main.yml')

diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
new file mode 100644
index 0000000..f4c2104
--- /dev/null
+++ b/roles/sshd/tasks/main.yml
@@ -0,0 +1,63 @@
+- name: "sshd role version"
+  shell: |
+    [ "{{ sshd_version }}" = "1" ] || \
+      (echo "Unexpected version {{ sshd_version }}" 1>&2; exit 1)
+
+- name: "Set SSH host identity"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      {{ sshd_host_key }}
+    dest: /etc/ssh/ssh_host_key
+    owner: root
+    group: root
+    mode: 0600
+  notify: sshd_restart
+
+- name: "Set SSH host certificate"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      {{ sshd_host_cert }}
+    dest: /etc/ssh/ssh_host_key-cert.pub
+  notify: sshd_restart
+
+- name: "Configure SSH server host key"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  copy:
+    content: |
+      HostKeyAlgorithms ssh-ed25519
+      HostKey /etc/ssh/ssh_host_key
+      HostCertificate /etc/ssh/ssh_host_key-cert.pub
+    dest: /etc/ssh/sshd_config.d/host_id.conf
+  notify: sshd_restart
+
+- name: "Remove obsolete SSH host keys and certificates"
+  when: sshd_host_key is defined and sshd_host_cert is defined
+  shell: |
+    find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete
+  notify: sshd_restart
+
+- name: "Configure SSH server port"
+  when: sshd_port is defined
+  copy:
+    content: |
+      Port {{ sshd_port }}
+    dest: /etc/ssh/sshd_config.d/port.conf
+  notify: sshd_restart
+
+- name: "Configure user CA for SSH server"
+  when: sshd_user_ca_pub is defined
+  copy:
+    content: |
+      {{ sshd_user_ca_pub }}
+    dest: /etc/ssh/user_ca_pubs
+  notify: sshd_restart
+
+- name: "Configure SSH server to accept user CA"
+  when: sshd_user_ca_pub is defined
+  copy:
+    content: |
+      TrustedUserCAKeys /etc/ssh/user_ca_pubs
+    dest: /etc/ssh/sshd_config.d/user_ca.conf
+  notify: sshd_restart
-- 
cgit v1.2.1