From a347880d4c4ad9fca5a09322670737b8f7266be1 Mon Sep 17 00:00:00 2001
From: Fabio Scotto di Santolo <fscottodev@pm.me>
Date: Sun, 13 Sep 2026 14:46:08 +0200
Subject: [PATCH] Manage Aegis SSH authorized key fragments

---
 ansible/inventory/host_vars/aegis.yml      |  9 +++++---
 ansible/roles/profile_aegis/tasks/main.yml | 27 ++++++++++++++++------
 2 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/ansible/inventory/host_vars/aegis.yml b/ansible/inventory/host_vars/aegis.yml
index 143577e..6fc2f0b 100644
--- a/ansible/inventory/host_vars/aegis.yml
+++ b/ansible/inventory/host_vars/aegis.yml
@@ -10,8 +10,11 @@ ansible_ssh_use_tty: false
 aegis_lan_subnet: 192.168.178.0/24
 aegis_adguard_web_port: 80
 aegis_ssh_authorized_keys:
-  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
-  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
-  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 
 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"
diff --git a/ansible/roles/profile_aegis/tasks/main.yml b/ansible/roles/profile_aegis/tasks/main.yml
index ae49399..f609d3d 100644
--- a/ansible/roles/profile_aegis/tasks/main.yml
+++ b/ansible/roles/profile_aegis/tasks/main.yml
@@ -165,14 +165,27 @@
     path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
   register: aegis_authorized_keys
 
-- name: Manage Aegis SSH authorized keys
+- name: Ensure Aegis SSH authorized key fragments directory exists
   tags: [aegis, ssh, services]
-  ansible.posix.authorized_key:
-    user: "{{ ansible_user }}"
-    key: "{{ aegis_ssh_authorized_keys | join('\n') }}"
-    state: present
-    exclusive: true
-    manage_dir: true
+  ansible.builtin.file:
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0700"
+  when: aegis_ssh_authorized_keys | length > 0
+
+- name: Manage Aegis SSH authorized key fragments
+  tags: [aegis, ssh, services]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d/{{ item.name }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0600"
+  loop: "{{ aegis_ssh_authorized_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
   when: aegis_ssh_authorized_keys | length > 0
 
 - name: Find Aegis SSH authorized key fragments