Manage SSH authorized key fragments for infrastructure hosts

AGENTS.md

@@ -134,8 +134,8 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `atlas_manage_storage`, `atlas_manage_sharing`, and `atlas_manage_firewall` are enabled in Atlas host vars as
   the declared steady state; set one false only for a deliberate suspension. `atlas_manage_media_stack` remains false
   until the future rootful Immich stack has its required Vault inputs and target validation.
-- Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit
+- Atlas requires `vault_atlas_admin_password_hash` for Cockpit and, while sharing is enabled,
-  and, while sharing is enabled, `vault_atlas_samba_password`. The future rootful media stack also requires
+  `vault_atlas_samba_password`. The future rootful media stack also requires
   `vault_atlas_immich_db_password`. Never print these values.
 - Atlas creates the complete declared hierarchy only under the verified existing or explicitly bootstrapped pool: `work`, `archive`,
   `archive/app_data`, `archive/app_data/navidrome`, `archive/app_data/syncthing`, `media`, `media/music`,
@@ -178,8 +178,9 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
   or API access for the selected clients.
 - Validate the managed WireGuard path and its LAN/VPN-only firewalld rules before enabling remote services;
   never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
-- Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity,
+- Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared
-  pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer.
+  read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key,
+  atomic pull, verification, retention and systemd service/timer.
 - Add the encrypted offsite backup with Borg to a Hetzner Storage Box: use a dedicated SSH identity,
   pin the host key, keep Borg repository credentials and encryption material in Vault, use
   snapshot-consistent sources, and manage retries, logging, pruning, repository checks and restores.

README.md

@@ -133,6 +133,8 @@ ansible-playbook ansible/site.yml --limit prometheus \
 ```
 
 The target must already provide `server_username` with local sudo access.
+Prometheus authorizes its declared SSH public keys through separate files below
+`~/.ssh/authorized_keys.d/`, while `sshd` is configured to read those files directly.
 
 ### DuckDNS
 
@@ -215,8 +217,8 @@ only manages child datasets. A one-time RAIDZ2 bootstrap is available only with
 It never partitions, forces, destroys, rolls back, or changes the vdev layout of an existing pool. Linux
 clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the configured LAN.
 
-For the first run, provide `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
+For the first run, provide `vault_atlas_admin_password_hash`, `vault_atlas_samba_password`, and
-`vault_atlas_samba_password`, and `vault_atlas_immich_db_password`. Bootstrap the host through its
+`vault_atlas_immich_db_password`. Bootstrap the host through its
 existing administrator:
 
 ```bash
@@ -228,7 +230,8 @@ ansible-playbook ansible/site.yml --limit atlas \
 Cockpit password. Subsequent runs use `atlas_admin_username`. Atlas declares storage, sharing, and its
 LAN firewall rules enabled. Before the first apply, check the existing pool and mountpoints, LAN subnet,
 and active firewalld zone. `atlas_manage_media_stack` remains disabled until `/dev/dri`, the container
-paths, and the Immich database secret are validated.
+paths, and the Immich database secret are validated. Atlas reads its declared SSH public keys from
+separate files below `~/.ssh/authorized_keys.d/`.
 
 With storage management enabled, Atlas creates the complete dataset hierarchy below the existing or
 explicitly bootstrapped `zpool`: `work`, `archive`, `archive/app_data`, the separate `archive/app_data/navidrome` and

ansible/inventory/group_vars/server.yml

@@ -95,3 +95,5 @@ server_sshd_settings:
 
 server_sshd_allow_users:
   - "{{ server_username }}"
+server_ssh_authorized_keys: []
+server_ssh_authorized_key_directory: "{{ server_user_home }}/.ssh/authorized_keys.d"

ansible/inventory/host_vars/atlas.yml

@@ -12,7 +12,13 @@ atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
-atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
+atlas_admin_ssh_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
 atlas_ssh_allow_tcp_forwarding: local
 

ansible/inventory/host_vars/prometheus.yml

@@ -7,6 +7,13 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
 server_username: rocky
 server_duckdns_domain: fscotto
+server_ssh_authorized_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 
 wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.1/24

ansible/roles/profile_atlas/defaults/main.yml

@@ -10,6 +10,7 @@ atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
 atlas_admin_ssh_keys: []
+atlas_admin_ssh_key_directory: "{{ atlas_admin_home }}/.ssh/authorized_keys.d"
 atlas_admin_password_hash: "!"
 # Local forwarding permits an administrator to tunnel a private service without allowing remote forwards.
 atlas_ssh_allow_tcp_forwarding: local

ansible/roles/profile_atlas/tasks/account.yml

@@ -9,8 +9,8 @@
       - atlas_ssh_allow_tcp_forwarding in ['no', 'yes', 'local', 'remote', 'all']
       - "'wheel' not in atlas_immich_supplementary_groups"
     fail_msg: >-
-      Define atlas_admin_username, vault_atlas_authorized_ssh_keys and
+      Define atlas_admin_username, atlas_admin_ssh_keys and vault_atlas_admin_password_hash
-      vault_atlas_admin_password_hash before applying the Atlas profile.
+      before applying the Atlas profile.
   no_log: true
 
 - name: Create Atlas administrator group
@@ -78,13 +78,26 @@
     mode: "0440"
     validate: "visudo -cf %s"
 
-- name: Manage Atlas administrator authorized SSH keys exclusively
+- name: Ensure Atlas administrator SSH authorized key fragments directory exists
   tags: [atlas, services]
-  ansible.posix.authorized_key:
+  ansible.builtin.file:
-    user: "{{ atlas_admin_username }}"
+    path: "{{ atlas_admin_ssh_key_directory }}"
-    key: "{{ atlas_admin_ssh_keys | join('\n') }}"
+    state: directory
-    state: present
+    owner: "{{ atlas_admin_username }}"
-    exclusive: true
+    group: "{{ atlas_admin_group }}"
+    mode: "0700"
+
+- name: Manage Atlas administrator SSH authorized key fragments
+  tags: [atlas, services]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ atlas_admin_ssh_key_directory }}/{{ item.name }}"
+    owner: "{{ atlas_admin_username }}"
+    group: "{{ atlas_admin_group }}"
+    mode: "0600"
+  loop: "{{ atlas_admin_ssh_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
 
 - name: Check whether the Atlas SSH host key exists
   tags: [atlas, services]

ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2

@@ -4,6 +4,7 @@ PubkeyAuthentication yes
 PasswordAuthentication no
 KbdInteractiveAuthentication no
 AuthenticationMethods publickey
+AuthorizedKeysFile {% for key in atlas_admin_ssh_keys %}%h/.ssh/authorized_keys.d/{{ key.name }}{% if not loop.last %} {% endif %}{% endfor %}
 X11Forwarding no
 AllowTcpForwarding {{ atlas_ssh_allow_tcp_forwarding }}
 AllowAgentForwarding no

ansible/roles/profile_server/tasks/main.yml

@@ -61,6 +61,42 @@
   tags: [services, podman]
   ansible.builtin.include_tasks: podman-compose.yml
 
+- name: Ensure server SSH authorized key fragments directory exists
+  tags: [services, ssh]
+  ansible.builtin.file:
+    path: "{{ server_ssh_authorized_key_directory }}"
+    state: directory
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0700"
+  when: server_ssh_authorized_keys | length > 0
+
+- name: Manage server SSH authorized key fragments
+  tags: [services, ssh]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ server_ssh_authorized_key_directory }}/{{ item.name }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0600"
+  loop: "{{ server_ssh_authorized_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: server_ssh_authorized_keys | length > 0
+
+- name: Configure server SSH authorized key fragments
+  tags: [services, ssh]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*AuthorizedKeysFile\s+'
+    line: >-
+      AuthorizedKeysFile {{ server_ssh_authorized_keys | map(attribute='name')
+      | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/') | join(' ') }}
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  when: server_ssh_authorized_keys | length > 0
+
 - name: Disable SSH root login on server
   tags: [services]
   ansible.builtin.lineinfile:

secrets/vault.yml

@@ -1,92 +1,71 @@
 $ANSIBLE_VAULT;1.1;AES256
-39613737656234646631643933343136616133616631646435313739613739646232323939643939
+34663237313764396365646239613936373362306636663862373964343131636362333265306564
-3530316437326161653531626464633034643332343539390a353161623661366434386339336533
+3739343661336433303637343066626263646530663464380a636363303065643130336239663335
-64646239383036373863623866633532666433626165326662633935383961316636653462316664
+64323265303964383635366235656163353333393166363635333831343531356339363939333530
-3338313762363130310a643765656337316664323531343666346331383835666664383936393161
+6266306339323862300a353530623639643836323135363566653161356630316565323233333937
-65623631643438333837353638613934353766656334616565363430373462323466663963306564
+34343637383766623036633435346131393935303736613963653762663336383336366666333961
-37333436633266336163396566373530326636303537313864306637323462346461656366373234
+39346336356563383464306364373438666638353731616566656164386365373966623230313933
-63383330633836393534646665613966646435656438303230636364616538646438643132623166
+61343237373034616163363733326139306665366339383866316666396138373164366363613164
-61646237313835336363333733343634386536356436643131386630656431363238666330646633
+34313638373435623439326164396264393838316263633630653935626635333362386132313864
-65316261363639346231613364303939303334623832353766613736336434306336656636336366
+34643937653730336637633137623937346131396330356665626564666561343630383562646563
-33643563343961306164326466323730613334613330306133373139636235646238366334626233
+65393532656162323931663266323635343437613639373731623631636533326533396662373032
-33306161613436313337663133393664643663336635623536366137613462633532316636313730
+61386436613235353638613731313835373137643533363936326566316165636137653438393238
-65633433393431383661653933376563633234373763666334633339376133373733623233643034
+37343765356366626666363162663262313663393038323531346461343731396334623339323865
-64643265333539396531366539303861393837303037363832353763323438306639303865663239
+65323464323465326364633263346561316364336431323763386138383132643136663630636439
-32333635616236363131356163343366343862353735356563663733346535646663613862643162
+66393564343462663933626464623866613563376234663430353837343139346363313539313839
-32313635343932396362623138393036633262303963623763643736333337333730306531613164
+65386134653932393464356562346238336535323130373235303964313664363031623137383365
-31353934323238336663386633616232653162616338373136373635343139343337656138623037
+39356530666564383334626330613039303135626237393233353362363033653239343634356261
-64616161633564393863633564386665306462646234663162646136656430313835386137333939
+35356533643937393834383930336633623932363435646261633837663536356462356535613030
-39626561616135663638633261356335366431653230633264383939363033363632386562616534
+63626438393466616238383030643631343661613630623738323933386434636461383136376261
-35303465383562383233353463313733393662353036393936346134376430313761653861636136
+39616137336134663130613234633266383434336133353334373063366232663839316536376565
-30333136356331303066336336366433653165393731353732313533653431363634666266663433
+62643766316464393135633564373062663335633533626631326534333232323364343133393534
-31323266333665393739363339333463633463623836646161633633316164336161386636633666
+63396465363066643261303334363966343935323635383938616539323838393235373730313832
-64323039653261333731643033383166653334646661626434323234346638353531653731633733
+37313235316264643932343062353162353534653963336634373264343937653035333735393766
-65363335363236653935323130643662336636343734383231343433626261353363333330396661
+32393765643535383535616335613136336566653637343835366538633737313962336531333533
-30336133663364363064623066303266343732383538346162656465663361626236316166326466
+32376163613861313139393863646331386133363435373364316134376533316136396533353161
-66366536316533633339336666363836636138396133366534366365616430376632636563306464
+39353737633439656466396561623938646438636664373438323866613636653963393938346363
-36643334393565363363626339343061333433383133613865323831653034303432323439646439
+63616366313030623464613832336566356339343931643436393138346463356161653039666632
-37353235613662346633613461373137626131336164393832383235663939613366303733333663
+63396465306630336634316632663930613637643331363236353363383162333865383536623235
-32396334653336353534346338306637386361326334313032366636636636666265633534393033
+33306232333439383135306266656666616135363433636332663865633234653530666435356164
-66356430333866383332343132656635303262336661313735656632626561373938366265666265
+34336338343831633966666334643436373162336333313666613766656638656530373663383036
-32653630366166313736396464613638396465616362386363346539326464313632306136346538
+39366134326134323435326434383637313334336562386638346333303666396336653231396463
-66663839626639323033313236343162643632323039636563643166623364643063393064356364
+37633131393564656265646530373262393231373663303133323566666630366530626439353062
-38356662353965313239356339326563303562353735623236396332333035326138353162333961
+37323138656431653235303439653133303831383864376562353363373466396334373063616561
-31303562616166393964363233393564366666613331316263363838316635653631636436343537
+34343932383433323331363633643432303633323337656261386339653263393832396539633938
-65666434356438383365353539333339616162643737626163353866663336336165626430636562
+36303634336162613366376435366530663632656263363436666532663561636465613736303962
-35643563646562323938396464303339613265633132623862396561666665653032653531393065
+35663035303437313933373533336639323563376539303730323933346636626462336530303135
-35623761623230643434313133346639383438613934306631616366656534333561333337323938
+65623036326663363130326438376161303463363839653564623462663561346236393262643035
-37643533306361373137376433383334306137613034623665386638303738386337616365313762
+63363631663834303734393330353730333234626236616636326236376133633635376435326630
-35386138366630306534346538333637303135643262313638323466623937623366663938613461
+33383035363466326139336431353937363236303134633662653066356164656366353038366264
-61303439326665306139323039613032343436313966623862306464623966343362633761323135
+63343261393865303163633166663433373362663261343166303932313061393463346662366165
-31623262646166303235633935663034363139393737353737353538336662313833396639326562
+31396333633964636265326539396533343932363433636438363137356430663764373835373566
-61386539383430623462353264306566633562373030656639386163646534653035633064623738
+63633265323537353666653862623030646661366531646163303261363035356138346538623466
-39616665666334613537366362376235336630393066316563323832636632326165646635366331
+63323235393835353864303362356465393739303531653139316338643136346164366630383635
-64346239323033303665326533393038303236663736653435643662346330373166306435646430
+64376261376465303134383938346639386563363532313532663532656462663362643339353733
-36303136623466396234336232366234633235313234346239356435633533356264386236353432
+61356566613638336639323235393132623032303639393065363238366337333237363863326365
-61613264656664633035376331366131613865633462616161613763353239323765366438323266
+32383563313062363166656137626639363138363236383763663262363531646133356434633636
-39383034303130316339663431366263376631343131633362623566633638393164393232396266
+39653666626539356538313234636634386438386434303336313337323638383863376163356365
-66663637623637613831653463383532323539623361656466383634623131633962396561633361
+32346330306361343337373636376239643538396334303038636664633666306562316435303332
-66376164613665306239336164356564616230306335343363326433376237646330613263323534
+33663238336336353237396139633133386439376162616439313862323462613636646262326162
-33303663396239633934613864633433313264336431363732333038343766663835666636643438
+62653237636161393938336435333730636237313363663835323932613933373466343163646331
-36376638396539313063646464386537656330613537343462386563643135323363383537643232
+37383466386437303433616162323433343761623831323163363331613164376565623633356335
-32323930646338326564316635326463623063373161623338623865353837626135326438343961
+61366336393938383036623962353031333735376266643866363562653965306335636531376138
-32323236363936373564646530323165616664393166313135626630346166363261353538656365
+64303764343565376561623933663035646163343235646565666465323864323065636462383962
-31633161393739643339303830313731386333393138346437666130333565653439626165303636
+66633336313032323333366237366561613734376132346537373136376639623163313837613235
-66623466663534333039343738363130383234373638333362383135396239633763343264316333
+37393332323539303338353365373766383537626162613738343534396339613336323437646466
-39623135663636313565643633383232616531623431383438383730643035356666313065373431
+61623636303665623262633632653633373931373933366138316565353938656232313961373865
-66646239643333646630623364616439323836346334633336343434323162363865653761356539
+66393230663532616532666561666465313361316432376432313034343333636566626564323066
-31336136626337643862313938363762393263303565326135333465393633303366336531373130
+34613331633439626233333939303461393239623262376265393132313134653537396165343262
-32366163333638393337323438316633626365646238663035646538393638363637323034653430
+39303135366566623037646265616630313638383732323064303237626334383261303230383162
-39613434633730363461373338376232376630376134653333313634303862373839663039303265
+66633164353330666436376666316236363164373230633062636430663632393837366630643539
-64616264616134643432353431356139653965356131623862633061326236346631306166656661
+33663233306464616165613337633030656661393336613036333036666565356232333966616361
-63616531386564663261313566646565396439363762313438393339383165333936653230613230
+62353465643839373266333866353135396262303461666465393736636638636462666136613461
-63666335376431316435313535626137313662633137376635396365306565346465373631306462
+31373130663563393833633930323766656530616261323363383333306631653563363734343034
-36393066373065313934366161616431626463623130663133346534303437643834383837333938
+64383962346463663861356362346437346630353835383062373433396335343931343462386165
-35366530303962383230386531653334336632363439306633303330343638316161636264646661
+33636266306563346431376438333463653165663962346262633037393238393135323536633866
-33623239396234653562663332313465353239323339366632643138663363393130653037316430
+65623663323365643233346232613936373562363532373162613533316335376138366432316362
-65383936313937303531366632306538626661626531636638643662623333376335343866623662
+30303662363436636263313064363235393632353430386438663833666665316561323431396430
-31363130643037663032323739353436356430383462656633336238336462346563666538383166
+64623435323461313763613730643762633535393533333635313435613665383535633161353539
-65653932663262656331356136663130333365636564316537353037383430333464663037323637
+37666665313730663366646537363963636631363836353437663963656566353962633935383263
-36666337306261313533666233653735363639393164373339313137393337636534323966386466
+38663930373135353336326530396636373938333934326630303138643563633934656566663963
-32633633346131656164353562616430643262376466316437356135366330366564356432616539
+6461373661386230356262643732373861366139323261303961
-36643337626664333731383939393662376162333161656534656432306263653438373137373563
-39343739373663363539616666663364646133393437383631346630643733656333323131643361
-32643165646130313637373561613938383565393838663965616339666663353538386262613831
-62653362373738373562646430313335623439346233663264326638306131306161623963636639
-35636139376338323530666633363437353931343438303639333835656135633038323336653261
-64393164326638336434393061383565653631356361653661373363363361366538333434383939
-65303139386262373330393865323965333937313434633261653962336630346234663766313537
-61323662633739363538393730326161616365346439343038613266613165373434613864626139
-35393261363237656665343962343035306332336630313138376661663938393336626336636662
-33653732393933646639323739303565616630356262613263363165376139363039316166653964
-61316630623139656331313864626261363232623765396139313339393564373935323132363837
-61363432633932393634383762316565393065323430333533363538353539663237313037643433
-64303430386262626135353739633038633837393037313135346334643231636163633463626234
-36336337633462613435346434643932303463396265653933306464336132323961656363353235
-64336332613035306564383066363936326133383630343230653238303762393166626563353833
-39316335303361303466623463393162333663636333363432393661656638306564356435363661
-30666664386633376439623864336366363338633330663066343563663066363562313239323030
-63353865366638663666363032616234343437613330353739336332326139323534356439376165
-63303938643039363330643363633632333864613639663838643432326237616665626434353464
-34363737366133323037656234643534373835346166363534653635323930313430343337623833
-386535373562653337356164376531646433

secrets/vault.yml.example

@@ -11,8 +11,6 @@ vault_git_work_gpg: "REPLACE_ME"
 vault_openai_api_key: "REPLACE_ME"
 vault_ikaros_authorized_ssh_keys:
   - "ssh-ed25519 REPLACE_ME"
-vault_atlas_authorized_ssh_keys:
-  - "ssh-ed25519 REPLACE_ME atlas-admin"
 vault_atlas_admin_password_hash: "REPLACE_WITH_A_SHADOW_COMPATIBLE_HASH"
 vault_atlas_samba_password: "REPLACE_ME"
 vault_atlas_immich_db_password: "REPLACE_ME"