extract roles

ansible/roles/ssh/files/ssh_user_certificate.conf

@@ -1,2 +0,0 @@
-CertificateFile /etc/ssh/ssh_user_ed25519_key-cert.pub
-IdentityFile /etc/ssh/ssh_user_ed25519_key

ansible/roles/ssh/tasks/main.yml

@@ -1,73 +0,0 @@
-- name: Generate user key pair
-  openssh_keypair:
-    path: /etc/ssh/ssh_user_ed25519_key
-    type: ed25519
-    comment: "{{ ansible_fqdn }}"
-  register: user_key
-
-- name: Check whether user certificate exists
-  stat:
-    path: /etc/ssh/ssh_user_ed25519_key-cert.pub
-  register: cert_stat
-
-- name: Generate SSH user certificate
-  command:
-    cmd: "ssh -o ConnectTimeout=3 -o ConnectionAttempts=1 root@atlas.hyp '/root/ssh_ca/ssh_ca.sh user hyp_user \"{{ user_key.public_key }}\" {{ ansible_fqdn }} \"hypervisor\"'"
-  register: user_certificate
-  delegate_to: localhost
-  when: not cert_stat.stat.exists
-
-- name: Place user certificate
-  copy:
-    dest: /etc/ssh/ssh_user_ed25519_key-cert.pub
-    content: "{{ user_certificate.stdout }}"
-    mode: 0644
-  when: not cert_stat.stat.exists
-
-- name: Enable user certificate
-  copy:
-    src: "{{ role_path }}/files/ssh_user_certificate.conf"
-    dest: /etc/ssh/ssh_config.d/user_certificate.conf
-
-- name: Add SSH host CA known host
-  known_hosts:
-    key: '@cert-authority *.dmz ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x Host Certficate Authority for DMZ'
-    name: '@cert-authority *.dmz'
-    path: /etc/ssh/ssh_known_hosts
-
-- name: Add SSH host CA known host
-  known_hosts:
-    key: '@cert-authority *.hyp ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzRkH3d/KVJQouswY/DMpenWbDFVOnI3Vut0xR0e1tb Host Certficate Authority for HYP'
-    name: '@cert-authority *.hyp'
-    path: /etc/ssh/ssh_known_hosts
-
-- name: Generate host key pair
-  openssh_keypair:
-    path: /etc/ssh/ssh_host_ed25519_key
-    type: ed25519
-    comment: "{{ ansible_host }}"
-  register: host_key
-
-- name: Check whether host certificate exists
-  stat:
-    path: /etc/ssh/ssh_host_ed25519_key-cert.pub
-  register: cert_stat
-
-- name: Generate SSH host certificate
-  command:
-    cmd: "ssh -o ConnectTimeout=3 -o ConnectionAttempts=1 root@atlas.hyp '/root/ssh_ca/ssh_ca.sh host hyp_host \"{{ host_key.public_key }}\" {{ ansible_host }}'"
-  register: host_certificate
-  delegate_to: localhost
-  when: not cert_stat.stat.exists
-
-- name: Place host certificate
-  copy:
-    dest: /etc/ssh/ssh_host_ed25519_key-cert.pub
-    content: "{{ host_certificate.stdout }}"
-    mode: 0644
-  when: not cert_stat.stat.exists
-
-- name: Enable host certificate
-  copy:
-    dest: /etc/ssh/sshd_config.d/sshd_host_certificate.conf
-    content: "HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"