build

roles/init/tasks/main.yml

@@ -104,11 +104,28 @@
         group: root
         mode: '0644'
 
+    - name: Read SSH CA public key from Vault
+      ansible.builtin.command:
+        cmd: vault read -field=public_key ssh/config/ca
+      register: vault_ca
+      changed_when: false
+      environment:
+        VAULT_ADDR: "{{ vault_addr }}"
+        VAULT_TOKEN: "{{ vault_token }}"
+
+    - name: Install trusted SSH user CA
+      ansible.builtin.copy:
+        content: "{{ vault_ca.stdout }}\n"
+        dest: /etc/ssh/trusted-user-ca-keys.pem
+        owner: root
+        group: root
+        mode: '0644'
+
     - name: Enable Trusted User CA
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: "^TrustedUserCAKeys"
-        line: "TrustedUserCAKeys /etc/ssh/trusted_user_ca.pub"
+        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
         state: present
 
     - name: Enable PubkeyAuthentication