build

init.yml

@@ -1,14 +1,16 @@
 $ANSIBLE_VAULT;1.1;AES256
-37376436636363643032623234396230623134633462626161383931633461623463356263663061
-3363336364373538636236613037653336623437646434660a366464323232663632663864393566
-31346635656461306231613331376334313962626331613631343835663836643033383030623165
-3932616339626462310a333633393739616133383232333239346263393135353338373763376530
-31303333663237333365373163633639653830386234623534643864313134356236386464336663
-37393630613436636432643163363266343165653238663365386261346261343137306230653863
-32326461623733373636623065313132616161636239393731373965373165356636303638366662
-32613139333066613337383035323264336431633233316463343061333533663436613434613463
-65393435626665303232306261373961393938336530373761613366646234333564643432376561
-35663763653838636630653863346239373439343834343764373630643965626361363733343333
-39346637326436373965653333336332633037646439343037623835373533303962633632346162
-65376532356337636466633863356165613363303861653231353736643939643166626364613061
-6530
+37663463663061623965643732393436333264376564643935633139643937313732343565633833
+3862356533396436613332303933643462303665643235640a383364386165333031616365363662
+38366234653735626438663133343963343930333961306465613563323832333133353962363766
+3562326635346634330a353964666166313930653466343636353132353365313461366539343037
+32323732323433643439623963326535383861663030383163623939353239373137326539313433
+35376331353636643063366230363465636562303336663135623661313961663830373263616466
+33636135666132373763396438656133393663616535643332613135666238396666336430613263
+30666134356433343438336332323531333762313833306461316633656632666135396632366532
+38633065613032373962396262393866656633633231316531303863663435396138623363626364
+64383863353661623331316566373437626538396264383533393462616536623639643030636534
+64336434343736343435656531643534393065333735646138346636363766393961626433383832
+33323731323837303965376265376438666432323630316538313961323262383038636235333361
+66383737656430313165613234653637376166643233666339663462373363333835663135376631
+34313262326466373134313535623032366661373537326262376437663230363964626639323533
+363038303831306336633335356535636563

roles/init/tasks/main.yml

@@ -104,11 +104,28 @@
         group: root
         mode: '0644'
 
+    - name: Read SSH CA public key from Vault
+      ansible.builtin.command:
+        cmd: vault read -field=public_key ssh/config/ca
+      register: vault_ca
+      changed_when: false
+      environment:
+        VAULT_ADDR: "{{ vault_addr }}"
+        VAULT_TOKEN: "{{ vault_token }}"
+
+    - name: Install trusted SSH user CA
+      ansible.builtin.copy:
+        content: "{{ vault_ca.stdout }}\n"
+        dest: /etc/ssh/trusted-user-ca-keys.pem
+        owner: root
+        group: root
+        mode: '0644'
+
     - name: Enable Trusted User CA
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: "^TrustedUserCAKeys"
-        line: "TrustedUserCAKeys /etc/ssh/trusted_user_ca.pub"
+        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
         state: present
 
     - name: Enable PubkeyAuthentication