- name: "Setup passwordless authentication from {{ ssh_relay_accessing_host }} to {{ ssh_relay_accessed_host }}"
  block:
    - name: Deploy ssh-relay ssh pivate key
      delegate_to: "{{ ssh_relay_accessing_host }}"
      ansible.builtin.copy:
        src: "~/.ssh/{{ relay_ssh_key_name }}"
        dest: "~/.ssh/{{ relay_ssh_key_name }}"
        # Make the ssh private key only readable/writable for its owner
        mode: '600'
      no_log: true

    - name: Authorize the ssh-relay key on the relay host
      delegate_to: "{{ ssh_relay_accessed_host }}"
      run_once: true
      authorized_key:
        user: "{{ ssh_relay_accessed_user }}"
        state: present
        key: "{{ lookup('file', relay_ssh_key_name + '.pub') }}"
        key_options: "command=\"echo 'This identity can only be used for port forwarding'\",restrict,port-forwarding"

- name: "Authorize the relay host on the {{ ssh_relay_accessing_host }}"
  tags:
    - ssh
  ansible.builtin.include_role:
    name: ssh_authorize_host
    apply:
      delegate_to: "{{ ssh_relay_accessing_host }}"
  vars:
    ssh_hostname: "{{ ssh_relay_accessed_host }}"