- name: Install dracut-crypt-ssh
ansible.builtin.shell: |
set -o pipefail
set -e
if [ -f /root/dracut-crypt-ssh-keys/ssh_dracut_ed25519_key ]; then exit 0; fi
wget -nv https://copr.fedorainfracloud.org/coprs/uriesk/dracut-crypt-ssh/repo/fedora-42/uriesk-dracut-crypt-ssh-fedora-42.repo -O /etc/yum.repos.d/dracut-crypt-ssh.repo
rpm-ostree refresh-md
if ! rpm-ostree status | grep dracut-crypt-ssh; then
rpm-ostree install --apply-live --assumeyes dracut-crypt-ssh
fi
if ! rpm-ostree kargs | grep -q neednet; then
rpm-ostree kargs --append "rd.neednet=1 ip=dhcp"
fi
sed -i '/^#[[:space:]]*install_items/s/^#[[:space:]]*//' /etc/dracut.conf.d/crypt-ssh.conf
sed -i 's/"222"/"22"/g' /etc/dracut.conf.d/crypt-ssh.conf
umask 0077
mkdir -p /root/dracut-crypt-ssh-keys
ssh-keygen -t rsa -m PEM -f /root/dracut-crypt-ssh-keys/ssh_dracut_rsa_key -N ""
ssh-keygen -t ecdsa -m PEM -f /root/dracut-crypt-ssh-keys/ssh_dracut_ecdsa_key -N ""
ssh-keygen -t ed25519 -m PEM -f /root/dracut-crypt-ssh-keys/ssh_dracut_ed25519_key -N ""
sed -i 's/# dropbear_ed25519_key="GENERATE"/dropbear_ed25519_key="\/root\/dracut-crypt-ssh-keys\/ssh_dracut_ed25519_key"/g' /etc/dracut.conf.d/crypt-ssh.conf
sed -i 's/# dropbear_rsa_key="GENERATE"/dropbear_rsa_key="\/root\/dracut-crypt-ssh-keys\/ssh_dracut_rsa_key"/g' /etc/dracut.conf.d/crypt-ssh.conf
sed -i 's/# dropbear_ecdsa_key="GENERATE"/dropbear_ecdsa_key="\/root\/dracut-crypt-ssh-keys\/ssh_dracut_ecdsa_key"/g' /etc/dracut.conf.d/crypt-ssh.conf
if [ -f /home/{{ username_on_the_host.stdout }}/.ssh/authorized_keys ]; then cp /home/{{ username_on_the_host.stdout }}/.ssh/authorized_keys /root/.ssh/; fi
dracut --force