- name: compile list of hosts using phonehome
  set_fact:
    phonehome_remotes: "{{ hosts | map_dict_values_to_subkey('phonehome') }}"
  changed_when: False

- name: compile pfremote ssh key list
  set_fact:
    # authorized_keys for user pfremote are joined from:
    #    data/hosts/...  parameter phonehome:
    # and from the keys at
    #    extra_ssh_keys_pfremote
    # the extra_ssh_keys_pfremote were taken from pfsense to make shure no system is blocked, even if there is no key in data/hosts/...
    #
    # keys are prepended by options
    #    no-pty
    #    permitopen=127.0.0.1:1,   if there is no permitopen   given with the key (limits -L to 127.0.0.1:1 == forbit -L)
    #   if there is no permitlisten already in the key:
    #   permitlisten=localhost:[phonehome.port|*]  (limits -R to localhost:phonehome.port

    pfremote_ssh_keys: "{{
      (
          phonehome_remotes.values() | extract_phonehome_ssh_keys
          +
          hostvars[inventory_hostname]['extra_ssh_keys_pfremote'] | default([])
      ) | ssh_key_enforce_no_pty | ssh_key_enforce_permitlisten | ssh_key_phonehome_rescue | sort
    }}"

- name: deploy pfremote SSH-Keys
  become: true
  authorized_key:
    user: pfremote
    key: "{{ pfremote_ssh_keys | join('\n') }}"
    exclusive: true
