From d1a11a71daa6898595f5dcebd9cb418e18d2559a Mon Sep 17 00:00:00 2001
From: Florian Fischer <florian.fischer@muhq.space>
Date: Sat, 13 Aug 2022 14:06:08 +0200
Subject: add ssh_authorize_host implementation

---
 tasks/main.yml | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 64 insertions(+), 4 deletions(-)

(limited to 'tasks/main.yml')

diff --git a/tasks/main.yml b/tasks/main.yml
index b2a8d54..e1cc02a 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,4 +1,64 @@
----
-- name: Template role
-  ansible.builtin.debug:
-    msg: "This is a template"
+- name: Authorize the "{{ ssh_relayed_hostname | default(ssh_hostname) }}" host key
+  tags:
+    - ssh
+  block:
+    - name: Retrieve the host's key
+      ansible.builtin.command: cat /etc/ssh/ssh_host_ed25519_key.pub
+      register: host_key
+      delegate_to: "{{ ssh_relayed_hostname | default(ssh_hostname) }}"
+      changed_when: false
+
+    - name: Authorize the host key on a linux host
+      when: ansible_facts['os_family'] != 'Windows'
+      vars:
+        known_hosts_path: "{{ system_known_hosts_path if system_known_hosts_file.stat.exists and system_known_hosts_file.stat.writeable else user_known_hosts_path }}"
+      block:
+        - name: Detect if global known hosts file is writable
+          ansible.builtin.stat:
+            path: "{{ system_known_hosts_path }}"
+          register: system_known_hosts_file
+
+        - name: Authorize the {{ ssh_hostname }} host key
+          vars:
+            host_line: "{% if ssh_port == 22 %}{{ ssh_hostname }}{% else %}[{{ ssh_hostname }}]:{{ ssh_port }}{% endif %}"
+          ansible.builtin.known_hosts:
+            path: "{{ known_hosts_path }}"
+            name: "{{ host_line }}"
+            key: "{{ host_line }} {{ host_key.stdout }}"
+
+        - name: "Authorize the {{ ssh_hostname }} IP addresses"
+          when: include_host_ip_addresses
+          block:
+            - name: Authorize the {{ ssh_hostname }} IPv4 Address
+              vars:
+                ipv4_address: "{{ lookup('community.general.dig', ssh_hostname) }}"
+                host_line: "{% if ssh_port == 22 %}{{ ipv4_address }}{% else %}[{{ ipv4_address }}]:{{ ssh_port }}{% endif %}"
+              ansible.builtin.known_hosts:
+                path: "{{ known_hosts_path }}"
+                name: "{{ host_line}}"
+                key: "{{ host_line }} {{ host_key.stdout }}"
+
+            - name: Authorize the {{ ssh_hostname }} IPv6 Address
+              vars:
+                ipv6_address: "{{ lookup('community.general.dig', ssh_hostname, 'qtype=AAAA') }}"
+                host_line: "{% if ssh_port == 22 %}{{ ipv6_address }}{% else %}[{{ ipv6_address }}]:{{ ssh_port }}{% endif %}"
+              ansible.builtin.known_hosts:
+                path: "{{ known_hosts_path }}"
+                name: "{{ host_line}}"
+                key: "{{ host_line }} {{ host_key.stdout }}"
+
+    - name: Authorize the host key on a windows host
+      when: ansible_facts['os_family'] == 'Windows'
+      vars:
+        ipv4_address: "{{ lookup('community.general.dig', ssh_hostname) }}"
+        ipv6_address: "{{ lookup('community.general.dig', ssh_hostname, 'qtype=AAAA') }}"
+        host_line: >-
+          {% if ssh_port == 22 %}{{ ssh_hostname }}{% else %}[{{ ssh_hostname }}]:{{ ssh_port }}{% endif %}"
+          {% if include_host_ip_addresses %}
+          ,{% if ssh_port == 22 %}{{ ipv4_address }}{% else %}[{{ ipv4_address }}]:{{ ssh_port }}{% endif %}"
+          ,{% if ssh_port == 22 %}{{ ipv6_address }}{% else %}[{{ ipv6_address }}]:{{ ssh_port }}{% endif %}"
+          {% endif %}
+      community.windows.win_lineinfile:
+        create: true
+        path: "{{ windows_system_known_hosts_path }}"
+        line: "{{ host_line }} {{ host_key.stdout }}"
-- 
cgit v1.2.3