# HINT: The private keys are encrypted. Run the playbook with --ask-vault-pass.
#       You'll find the password in the secrets.

# the host.keys are provided per systemname and not only per role.

- name: install ssh keys
  tags: ssh_hostkeys
  become: true
  copy:
    src: "{{ inventory_hostname }}/ssh-hostkeys/{{ item.name }}"
    # Searched in:
    #    roles/general/ssh_host_keys/files/perfact-mail-localdev/ssh-hostkeys/{ item.name }}
    #    roles/general/ssh_host_keys/perfact-mail-localdev/ssh-hostkeys/{ item.name }}
    # we use this one:
    #    roles/perfact-mail/files/perfact-mail-localdev/ssh-hostkeys/{ item.name }}
    #    roles/perfact-mail/perfact-mail-localdev/ssh-hostkeys/{ item.name }}
    #    roles/general/ssh_host_keys/tasks/files/perfact-mail-localdev/ssh-hostkeys/{ item.name }}
    #    roles/general/ssh_host_keys/tasks/perfact-mail-localdev/ssh-hostkeys/{ item.name }}
    #    files/perfact-mail-localdev/ssh-hostkeys/{ item.name }}
    #    perfact-mail-localdev/ssh-hostkeys/{ item.name }} on the Ansible Controller

    dest: "/etc/ssh/{{ item.name }}"
    owner: root
    group: root
    mode: "{{ item.mode | default('0644') }}"
  notify: reload ssh-server
  with_items:
  - { name: ssh_host_rsa_key, mode: "0600" }
  - { name: ssh_host_rsa_key.pub }
  - { name: ssh_host_ecdsa_key, mode: "0600" }
  - { name: ssh_host_ecdsa_key.pub }
  - { name: ssh_host_ed25519_key, mode: "0600" }
  - { name: ssh_host_ed25519_key.pub }
