Finish sshd role.

ansible/environments/laptop/host_vars/odolinux

@@ -9,6 +9,11 @@ users:
       - name: users
       - name: docker
       - name: libvirt
+    authorized_keys:
+      - yubikey
+      - main_fido
+      - backup_fido
+      - homeassistant
 zfs_snapshot_datasets:
   - zroot/linux/archmain/home
   - zroot/linux/archmain/be

ansible/roles/blank/handlers/main.yaml

@@ -1,4 +1,14 @@
-# - name: restart foo
+# - name: restart foo freebsd
+#   when: 'os_flavor == "freebsd"'
+#   listen: restart foo
 #   service:
 #     name: foo
 #     state: restarted
+
+# - name: restart ssh linux
+#   when: 'os_flavor == "linux"'
+#   listen: restart foo
+#   systemd:
+#     state: restarted
+#     name: foo
+#     daemon_reload: yes

ansible/roles/sshd/files/keys/backup_fido.pub

@@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo=

ansible/roles/sshd/files/keys/homeassistant.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICfmIPexKT+dzA8VpQ1nblAaDLYBorIc2WYQv+Lc4apk lizapolyudova@Lizas-Air.home.arpa

ansible/roles/sshd/files/keys/main_fido.pub

@@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo=

ansible/roles/sshd/files/keys/yubikey.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky cardno:000611194908

ansible/roles/sshd/files/rc.conf

@@ -0,0 +1 @@
+sshd_enable="YES"

ansible/roles/sshd/handlers/main.yaml

@@ -0,0 +1,14 @@
+- name: restart sshd freebsd
+  when: 'os_flavor == "freebsd"'
+  listen: restart sshd
+  service:
+    name: sshd
+    state: reloaded
+
+- name: restart ssh linux
+  when: 'os_flavor == "linux"'
+  listen: restart sshd
+  systemd:
+    state: reloaded
+    name: sshd
+    daemon_reload: yes

ansible/roles/sshd/tasks/freebsd.yaml

@@ -0,0 +1,10 @@
+- name: Enable services
+  copy:
+    src: "files/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: wheel
+  loop:
+    - src: rc.conf
+      dest: /etc/rc.conf.d/sshd

ansible/roles/sshd/tasks/linux.yaml

@@ -0,0 +1,6 @@
+- name: Enable services
+  systemd:
+    state: started
+    name: sshd
+    daemon_reload: yes
+    enabled: yes

ansible/roles/sshd/tasks/peruser.yaml

@@ -1,26 +1,23 @@
 - include_role:
     name: per_user
 
-# - name: Create directories
-#   file:
-#     name: "{{ account_homedir.stdout }}/{{ item }}"
-#     state: directory
-#     mode: 0700
-#     owner: "{{ account_name.stdout }}"
-#     group: "{{ group_name.stdout }}"
-#   loop:
-#     - ".config/foo"
+- name: Create ssh directory
+  file:
+    name: "{{ account_homedir.stdout }}/.ssh"
+    state: directory
+    mode: 0700
+    owner: "{{ account_name.stdout }}"
+    group: "{{ group_name.stdout }}"
 
-# - name: Copy files
-#   copy:
-#     src: "files/{{ item.src }}"
-#     dest: "{{ account_homedir.stdout }}/{{ item.dest }}"
-#     mode: 0600
-#     owner: "{{ account_name.stdout }}"
-#     group: "{{ group_name.stdout }}"
-#   loop:
-#     - src: foo.conf
-#       dest: .config/foo/foo.conf
+- name: Set authorized keys
+  authorized_key:
+    user: "{{ account_name.stdout }}"
+    key: |
+      {% for user in users[account_name.stdout].authorized_keys %}
+      {{ lookup('file', './files/keys/' + user + '.pub') }}
+      {% endfor %}
+    exclusive: true
+  notify: "restart sshd"
 
 - import_tasks: tasks/peruser_freebsd.yaml
   when: 'os_flavor == "freebsd"'

ansible/roles/users/defaults/main.yaml

@@ -5,3 +5,8 @@ users:
     gid: 11235
     groups:
       - name: wheel
+    authorized_keys:
+      - yubikey
+      - main_fido
+      - backup_fido
+      - homeassistant