feat(gitea): sync the OpenBao SSH CA public key into a Secret

Phase 3, step A of the SSH CA: Gitea's built-in SSH server needs the CA
key as SSH_TRUSTED_USER_CA_KEYS. A namespaced ESO webhook SecretStore
reads OpenBao's unauthenticated /v1/ssh-client-signer/public_key from
the in-cluster Service into Secret gitea-ssh-ca, so the key has one
source. Gitea is not wired to it yet; step B follows once the Secret
is verified to hold exactly the CA key (the ESO docs do not say how a
text/plain body without result.jsonPath is handled).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/inventory/pve_hosts.yml

@@ -75,3 +75,6 @@ claude-ws ansible_host=10.3.40.78 ansible_user=root
 # was verified.
 [ssh_ca]
 proxy-1.renner.uno
+proxy-2.renner.uno
+netbird.renner.uno
+edge-1.iot.renner.uno

ansible/roles/ssh-ca/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: Reload sshd
-  ansible.builtin.service:
-    name: "{{ 'sshd' if ansible_facts['os_family'] | default('') == 'RedHat' else 'ssh' }}"
-    state: reloaded
-  listen: "reload sshd"

ansible/roles/ssh-ca/tasks/main.yml

@@ -22,7 +22,6 @@
     owner: root
     group: root
     mode: "0644"
-  notify: reload sshd
 
 # sshd refuses all public key logins when RevokedKeys is set but unreadable,
 # so the file is always deployed, even when empty.
@@ -33,7 +32,6 @@
     owner: root
     group: root
     mode: "0644"
-  notify: reload sshd
 
 - name: Create the Claude account
   ansible.builtin.user:
@@ -98,7 +96,6 @@
         owner: root
         group: root
         mode: "0644"
-      notify: reload sshd
 
     - name: Test the full sshd config
       ansible.builtin.command: sshd -t
@@ -113,18 +110,41 @@
       ansible.builtin.fail:
         msg: "sshd -t failed with the SSH CA drop-in; it was removed again"
 
-- name: Reload sshd now
-  ansible.builtin.meta: flush_handlers
-
 - name: Read the effective sshd settings
   ansible.builtin.command: sshd -T
   changed_when: false
   register: ssh_ca_effective
 
+# Keyword case in sshd -T output differs between OpenSSH versions (mixed case
+# on 10.6), so the lines are compared lowercased.
 - name: Check sshd uses the CA, principals and revocation list
+  vars:
+    ssh_ca_effective_lines: "{{ ssh_ca_effective.stdout_lines | map('lower') | list }}"
   ansible.builtin.assert:
     that:
-      - "'trustedusercakeys /etc/ssh/trusted_user_ca_keys' in ssh_ca_effective.stdout_lines"
-      - "'authorizedprincipalsfile /etc/ssh/auth_principals/%u' in ssh_ca_effective.stdout_lines"
-      - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective.stdout_lines"
+      - "'trustedusercakeys /etc/ssh/trusted_user_ca_keys' in ssh_ca_effective_lines"
+      - "'authorizedprincipalsfile /etc/ssh/auth_principals/%u' in ssh_ca_effective_lines"
+      - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective_lines"
     fail_msg: "sshd -T does not show the SSH CA settings; another config line takes precedence"
+
+# The unit is sshd.service on Arch and RedHat, ssh.service on Debian/Ubuntu.
+# Ubuntu also lists sshd.service as a not-found alias, so the running one is
+# picked. sshd -T only parses the files, so the running daemon is reloaded on
+# every run; a reload keeps open sessions.
+- name: Read the service list
+  ansible.builtin.service_facts:
+
+- name: Reload the running sshd unit
+  vars:
+    ssh_ca_sshd_units: "{{ ansible_facts.services | dict2items | selectattr('key', 'in', ['sshd.service', 'ssh.service']) | selectattr('value.state', 'equalto', 'running') | map(attribute='key') | list }}"
+  block:
+    - name: Check exactly one sshd unit is running
+      ansible.builtin.assert:
+        that:
+          - ssh_ca_sshd_units | length == 1
+        fail_msg: "Expected one running sshd.service or ssh.service, found {{ ssh_ca_sshd_units }}"
+
+    - name: Reload sshd so the running daemon uses the CA config
+      ansible.builtin.systemd:
+        name: "{{ ssh_ca_sshd_units | first }}"
+        state: reloaded

kubernetes/apps/gitea/kustomization.yaml

@@ -16,6 +16,8 @@ resources:
   - networkpolicy.yaml
   # Nightly prune of old CI image builds (REN-1203).
   - package-retention.yaml
+  # OpenBao SSH CA public key for certificate logins.
+  - ssh-ca.yaml
   - kumamonitors.yaml
 configMapGenerator:
   - name: gitea-package-retention

kubernetes/apps/gitea/ssh-ca.yaml

@@ -0,0 +1,31 @@
+# Public key of the OpenBao SSH user CA (ssh-client-signer), for Gitea's
+# built-in SSH server to accept owner and claude-bot certificates. OpenBao
+# serves it unauthenticated; ESO reads it from the in-cluster Service, so the
+# key has one source and a CA rotation reaches Gitea within refreshInterval.
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: openbao-ssh-ca
+  namespace: gitea
+spec:
+  provider:
+    webhook:
+      url: http://openbao.openbao.svc.cluster.local:8200/v1/ssh-client-signer/public_key
+      method: GET
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-ssh-ca
+  namespace: gitea
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: SecretStore
+    name: openbao-ssh-ca
+  target:
+    name: gitea-ssh-ca
+  data:
+    - secretKey: trusted-user-ca-keys
+      remoteRef:
+        key: public_key

kubernetes/apps/paperless/gotenberg.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: gotenberg
-          image: gotenberg/gotenberg:8.38.1 # {"$imagepolicy": "flux-system:gotenberg"}
+          image: gotenberg/gotenberg:8.39.0 # {"$imagepolicy": "flux-system:gotenberg"}
           args:
             - "gotenberg"
             - "--chromium-disable-javascript=true"

kubernetes/apps/wiki/deployment.yaml

@@ -53,7 +53,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: wiki
-          image: gitea.renner.uno/konairius/wiki:build.1793086240 # {"$imagepolicy": "flux-system:wiki"}
+          image: gitea.renner.uno/konairius/wiki:build.1793094262 # {"$imagepolicy": "flux-system:wiki"}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true