[inventory] manage ssh connectivity in shared ssh.cfg usable outside of ansible with optional local overrides in ssh.cfg.local, use ssh.cfg in ansible and eliminate ssh config bleed from ~/.ssh/config, collect host key fingerprints in shared known_hosts file populated with fingerprints of reachable hosts

.gitignore

@@ -1,4 +1,4 @@
 .ansible/
 **/__pycache__
 **/.DS_store
-
+ssh.cfg.local

ansible.cfg

@@ -5,3 +5,6 @@ vars_plugins_enabled = host_group_vars,community.sops.sops
 collections_path = ./
 roles_path = ./galaxy-roles
 interpreter_python = python3
+
+[ssh_connection]
+ssh_args = -F ssh.cfg -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=known_hosts

inventories/chaosknoten/hosts.yaml

@@ -1,109 +1,33 @@
 all:
   hosts:
     ccchoir:
-      ansible_host: ccchoir.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     chaosknoten:
-      ansible_host: chaosknoten.hamburg.ccc.de
     cloud:
-      ansible_host: cloud.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     diday-staging-runner:
-      ansible_host: diday-staging-runner.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     eh22-wiki:
-      ansible_host: eh22-wiki.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     grafana:
-      ansible_host: grafana.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     tickets:
-      ansible_host: tickets.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     jitsi:
-      ansible_host: jitsi.hamburg.ccc.de
-      ansible_user: chaos
     keycloak:
-      ansible_host: keycloak.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     lists:
-      ansible_host: lists.hamburg.ccc.de
-      ansible_user: chaos
     mjolnir:
-      ansible_host: mjolnir.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     mumble:
-      ansible_host: mumble.hamburg.ccc.de
-      ansible_user: chaos
     netbox:
-      ansible_host: netbox.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     onlyoffice:
-      ansible_host: onlyoffice.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     pad:
-      ansible_host: pad.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     pretalx:
-      ansible_host: pretalx.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     public-reverse-proxy:
-      ansible_host: public-reverse-proxy.hamburg.ccc.de
-      ansible_user: chaos
     router:
-      ansible_host: router.hamburg.ccc.de
-      ansible_user: chaos
     wiki:
-      ansible_host: wiki.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     zammad:
-      ansible_host: zammad.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     ntfy:
-      ansible_host: ntfy.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     sunders:
-      ansible_host: sunders.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     renovate:
-      ansible_host: renovate.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     spaceapiccc:
-      ansible_host: spaceapiccc.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     acmedns:
-      ansible_host: acmedns.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     auth-dns:
-      ansible_host: auth-dns.hamburg.ccc.de
-      ansible_user: chaos
     forgejo-runner:
-      ansible_host: forgejo-runner.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     forgejo-runner-external:
-      ansible_host: forgejo-runner-external.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
 hypervisors:
   hosts:
     chaosknoten:

inventories/external/hosts.yaml

@@ -2,8 +2,6 @@ all:
   hosts:
     status:
       # TODO: Manually set up ufw on the host. Create a role for ufw.
-      ansible_host: status.hamburg.ccc.de
-      ansible_user: chaos
 base_config_hosts:
   hosts:
     status:

inventories/z9/hosts.yaml

@@ -1,25 +1,12 @@
 all:
   hosts:
     dooris:
-      ansible_host: dooris.ccchh.net
-      ansible_user: chaos
     light:
-      ansible_host: light.ccchh.net
-      ansible_user: chaos
     opensourcetorrents:
-      ansible_host: opensourcetorrents.ccchh.net
-      ansible_user: chaos
     pve01:
-      ansible_host: pve01.ccchh.net
     waybackproxy:
-      ansible_host: waybackproxy.ccchh.net
-      ansible_user: chaos
     yate:
-      ansible_host: yate.z9.ccchh.net
-      ansible_user: chaos
     z9-router:
-      ansible_host: z9-router.ccchh.net
-      ansible_user: chaos
 base_config_hosts:
   hosts:
     z9-router:

known_hosts

@@ -0,0 +1,34 @@
+acmedns.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJfH16gO1ybLxz/qSwUQxfucwkkKdtaCs3LTm6mn1WBw
+auth-dns.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICot4CncMY6YA5u6T579uS1zC0OCHqmKdqC1gJLeqVzQ
+ccchoir.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9ciwPXufyJe5GOktgR5C9wH+84xNxDwMC2/0ccEZOG
+chaosknoten.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3OQWuF+rFishyaGnrgyG5HGVocVlewxcYR3RaBaeAw
+cloud.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7ftSAggvJOW5WdzfocEAx5WGxrA6GgN9LozpX31R/w
+diday-staging-runner.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII3SR/4wX9dAAna7LNDbnrJdiO/GLMr3HTw1JEq8HWuI
+dooris.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4g3VSYVjuhgA8JRRplSD7bcjmb9XfFyu5SocHCWtT3
+eh22-wiki.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBmG79nqY//ZrSURf9EgRHZVU6YWvZVUtHnLpmXorZk
+forgejo-runner-external.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINP0sfgMZaNJEQxzDrvUdtTHE+cBRg6p4mFGuxe+C5YI
+forgejo-runner.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/d7nDDth7U/F/ZO0Ug3S8C0rBARj77UdSCwwPVDZw3
+grafana.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGlIh+jGr3pA+M0t+LBbXswdwX1vBFcMhuhz+4KOtbC+
+jitsi.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHQ7sD/LoHl2yiG6HsTujHGbmE72YdqXgtRDKrClqZA
+keycloak.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM4zJIin5wsYtPy6FfNBq4sWwwLAwD/YNQ8K438ePMXa
+light.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDTn7GK0USwNbONHR9gR4tc+B3iXAisNFIlmm21EUxm6
+lists.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7fbN5/jIDd0b6KHJtOjU1u1G6iBm967dym9IegHCji
+mjolnir.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMR+2CzZC91mT9oU2BbIAqPdl1m3sp2NAKWUoU/T2MKg
+mumble.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBosJxVv02kX8vdyZfQ8lSQJnNje9id2Dk9LBDwod4ni
+netbox.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAVLtLRFHBwhbh+rGvon3KvKYuASQ878me8rgXD0ndGq
+ntfy.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGASO8ZKHX2XUUNA3sdYTEsDnCgrb6M9UeiFsyXcERM3
+onlyoffice.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBfchhdp2p7+QKoZyQHgRiv+nnGK7scytJjca9WOQgmm
+opensourcetorrents.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLTNinzCymFZgt5Sb8pk89yfbj9MbiNENh1J0bWeyZh
+pad.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINysL9KOfnxojDyvPQnzXtHuT+UkqxyDry0vk23eIq1t
+pretalx.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIInDY4enlTPVohOSBgKc+f3bCFvYvDVYeWNcbYfftYPj
+public-reverse-proxy.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIexYb1btlzHhjjLRE1hWKOEd6Zuscn8/FgG8SLUjyCh
+pve01.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEFXcy9aD0sPpi+o5zvzy4Iw5jMmNjmJK9N8IVG0mrNk
+renovate.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN5vVef1U1k3CJx1wNG3PU35+9dAG7+j4Ffu+G7tMfM+
+router.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWM1wtkw+yVfZi2e3gRVTpjU3R8Doqlukiv1/ud6Kmv
+spaceapiccc.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtggIp8L5i8SWM++hByCQMZJJLnliT0Ost7T4LjzcPN
+status.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy1p5fPlmpJAVe8oO/eQjue1cBisxZhfpCizQFp1DTf
+sunders.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL10d+eTRCl/Ylzds1OvULvtQRhOd+oHqE7mxzomeyfk
+tickets.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGVt4P0NkXVlDyOoSMYRBkGnSa433SBb3ZGKvG8ycyp
+wiki.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG9zxa16pNhD/6Mrr4hhlLowA+3PS/a87EvOA3rSTrQD
+z9-router.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIISqrS1ZQIOO5t62YIHZ66kYkSNZweNfyvXF9o4Npy3X
+zammad.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJeoHcaAfZTkvzV464xFEiKhj1CLnO3tnB7A078wMw6e

ssh.cfg

@@ -0,0 +1,165 @@
+Include ssh.cfg.local
+
+Host acmedns
+	HostName acmedns.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host auth-dns
+	HostName auth-dns.hamburg.ccc.de
+	User chaos
+
+Host ccchoir
+	HostName ccchoir.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host chaosknoten
+	HostName chaosknoten.hamburg.ccc.de
+
+Host cloud
+	HostName cloud.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host diday-staging-runner
+	HostName diday-staging-runner.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host dooris
+	HostName dooris.ccchh.net
+	User chaos
+
+Host eh22-wiki
+	HostName eh22-wiki.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host forgejo-runner-external
+	HostName forgejo-runner-external.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host forgejo-runner
+	HostName forgejo-runner.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host grafana
+	HostName grafana.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host jitsi
+	HostName jitsi.hamburg.ccc.de
+	User chaos
+
+Host keycloak
+	HostName keycloak.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host light
+	HostName light.ccchh.net
+	User chaos
+
+Host lists
+	HostName lists.hamburg.ccc.de
+	User chaos
+
+Host mjolnir
+	HostName mjolnir.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host mumble
+	HostName mumble.hamburg.ccc.de
+	User chaos
+
+Host netbox
+	HostName netbox.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host ntfy
+	HostName ntfy.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host onlyoffice
+	HostName onlyoffice.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host opensourcetorrents
+	HostName opensourcetorrents.ccchh.net
+	User chaos
+
+Host pad
+	HostName pad.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host pretalx
+	HostName pretalx.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host public-reverse-proxy
+	HostName public-reverse-proxy.hamburg.ccc.de
+	User chaos
+
+Host pve01
+	HostName pve01.ccchh.net
+
+Host renovate
+	HostName renovate.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host router
+	HostName router.hamburg.ccc.de
+	User chaos
+
+Host spaceapiccc
+	HostName spaceapiccc.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host status
+	HostName status.hamburg.ccc.de
+	User chaos
+
+Host sunders
+	HostName sunders.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host tickets
+	HostName tickets.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host waybackproxy
+	HostName waybackproxy.ccchh.net
+	User chaos
+
+Host wiki
+	HostName wiki.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host yate
+	HostName yate.z9.ccchh.net
+	User chaos
+
+Host z9-router
+	HostName z9-router.ccchh.net
+	User chaos
+
+Host zammad
+	HostName zammad.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+