feat(ansible): SSH CA on netbird.renner.uno

proxy-2 verified (claude-bot cert login, sudo allow/deny as on proxy-1). netbird is the first Ubuntu host (OpenSSH_9.6p1 Ubuntu-3ubuntu13.20): unit ssh.service, which the role picks from service_facts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'feat(ansible): SSH CA on proxy-2' (#1470 ) from ssh-ca-proxy-2 into main
2026-10-27 10:36:21 +01:00 · 2026-10-27 09:33:35 +00:00 · 2026-10-27 10:31:42 +01:00 · 2026-10-27 09:25:47 +00:00 · 2026-10-27 10:24:41 +01:00 · 2026-10-27 09:09:51 +00:00
4 changed files with 21 additions and 16 deletions
@@ -75,3 +75,5 @@ claude-ws ansible_host=10.3.40.78 ansible_user=root
 # was verified.
 [ssh_ca]
 proxy-1.renner.uno
+proxy-2.renner.uno
+netbird.renner.uno
@@ -1,6 +0,0 @@
---
- name: Reload sshd
-  ansible.builtin.service:
-    name: "{{ 'sshd' if ansible_facts['os_family'] | default('') == 'RedHat' else 'ssh' }}"
-    state: reloaded
-  listen: "reload sshd"
@@ -22,7 +22,6 @@
    owner: root
    group: root
    mode: "0644"
-  notify: reload sshd

 # sshd refuses all public key logins when RevokedKeys is set but unreadable,
 # so the file is always deployed, even when empty.
@@ -33,7 +32,6 @@
    owner: root
    group: root
    mode: "0644"
-  notify: reload sshd

 - name: Create the Claude account
  ansible.builtin.user:
@@ -98,7 +96,6 @@
        owner: root
        group: root
        mode: "0644"
-      notify: reload sshd

    - name: Test the full sshd config
      ansible.builtin.command: sshd -t
@@ -113,18 +110,30 @@
      ansible.builtin.fail:
        msg: "sshd -t failed with the SSH CA drop-in; it was removed again"

- name: Reload sshd now
-  ansible.builtin.meta: flush_handlers
-
 - name: Read the effective sshd settings
  ansible.builtin.command: sshd -T
  changed_when: false
  register: ssh_ca_effective

+# Keyword case in sshd -T output differs between OpenSSH versions (mixed case
+# on 10.6), so the lines are compared lowercased.
 - name: Check sshd uses the CA, principals and revocation list
+  vars:
+    ssh_ca_effective_lines: "{{ ssh_ca_effective.stdout_lines | map('lower') | list }}"
  ansible.builtin.assert:
    that:
-      - "'trustedusercakeys /etc/ssh/trusted_user_ca_keys' in ssh_ca_effective.stdout_lines"
-      - "'authorizedprincipalsfile /etc/ssh/auth_principals/%u' in ssh_ca_effective.stdout_lines"
-      - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective.stdout_lines"
+      - "'trustedusercakeys /etc/ssh/trusted_user_ca_keys' in ssh_ca_effective_lines"
+      - "'authorizedprincipalsfile /etc/ssh/auth_principals/%u' in ssh_ca_effective_lines"
+      - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective_lines"
    fail_msg: "sshd -T does not show the SSH CA settings; another config line takes precedence"
+
+# The unit is sshd.service on Arch and RedHat, ssh.service on Debian. sshd -T
+# only parses the files, so the running daemon is reloaded on every run; a
+# reload keeps open sessions.
+- name: Read the service list
+  ansible.builtin.service_facts:
+
+- name: Reload sshd so the running daemon uses the CA config
+  ansible.builtin.systemd:
+    name: "{{ 'sshd.service' if 'sshd.service' in ansible_facts.services else 'ssh.service' }}"
+    state: reloaded
@@ -22,7 +22,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: gotenberg
-          image: gotenberg/gotenberg:8.38.1 # {"$imagepolicy": "flux-system:gotenberg"}
+          image: gotenberg/gotenberg:8.39.0 # {"$imagepolicy": "flux-system:gotenberg"}
          args:
            - "gotenberg"
            - "--chromium-disable-javascript=true"
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	9232937b85	feat(ansible): SSH CA on netbird.renner.uno ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details proxy-2 verified (claude-bot cert login, sudo allow/deny as on proxy-1). netbird is the first Ubuntu host (OpenSSH_9.6p1 Ubuntu-3ubuntu13.20): unit ssh.service, which the role picks from service_facts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:36:21 +01:00
k.renner	707f6ab840	Merge pull request 'feat(ansible): SSH CA on proxy-2' (#1470 ) from ssh-ca-proxy-2 into main ci/woodpecker/push/deploy-ssh-ca Pipeline was successful Details Reviewed-on: #1470	2026-10-27 09:33:35 +00:00
claude-botandClaude Opus 5.5	7600a9dbf9	feat(ansible): SSH CA on proxy-2 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details proxy-1 is verified: owner cert login as root (sk-ed25519 cert) and claude-bot cert login with the expected sudo rules both work. proxy-2 is its twin (same OpenSSH_10.6 banner). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:31:42 +01:00
k.renner	b12ef67002	Merge pull request 'fix(ansible): ssh-ca compares sshd -T output case-insensitively' (#1469 ) from ssh-ca-assert-case into main ci/woodpecker/push/deploy-ssh-ca Pipeline was successful Details Reviewed-on: #1469 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-27 09:25:47 +00:00
claude-botandClaude Opus 5.5	e6e0e44b6a	fix(ansible): compare sshd -T output case-insensitively ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details The second deploy-ssh-ca run on proxy-1 failed at the assert although all three settings were active: OpenSSH 10.6 prints them as TrustedUserCAKeys, AuthorizedPrincipalsFile and RevokedKeys, the check expected lowercase keywords. The run stopped before the reload, so the running sshd still has the old config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:24:41 +01:00
k.renner	39b7fc7fc3	Merge pull request 'fix(ansible): ssh-ca reloads sshd by its real unit name' (#1468 ) from ssh-ca-reload-fix into main ci/woodpecker/push/deploy-ssh-ca Pipeline failed Details Reviewed-on: #1468 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-27 09:09:51 +00:00
claude-botandClaude Opus 5.5	33dd968a25	fix(ansible): reload sshd by its real unit name on every run ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details The first deploy to proxy-1 failed at the reload: 'Could not find the requested service ssh'. proxy-1 is not Debian (banner OpenSSH_10.6 without distro suffix, root shell /usr/bin/bash), so the unit is sshd.service; the handler only special-cased RedHat. The unit is now picked from service_facts. The reload runs on every run instead of via a handler: sshd -T only parses the files, so after a failed reload a re-run with nothing changed would otherwise leave the running daemon on the old config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:05:19 +01:00
k.renner	d8813a68b7	Merge pull request 'feat(ansible): hosts trust the OpenBao SSH user CA (SSH CA phase 2)' (#1467 ) from ssh-ca-phase2 into main ci/woodpecker/push/deploy-ssh-ca Pipeline failed Details Reviewed-on: #1467	2026-10-27 08:53:33 +00:00
security-bot	d033503fc3	chore(image-automation): bump gotenberg/gotenberg:8.39.0 Updates managed by image-automation-controller.	2026-10-27 08:50:46 +00:00