Update to 2021-12-13 23:00

roles/common/defaults/main.yml

@@ -109,4 +109,17 @@ system_rc_local_shutdown_base_cmd: []
 system_rc_local_shutdown_extra_cmd: []
 system_rc_local_shutdown_cmd: "{{ system_rc_local_shutdown_base_cmd + system_rc_local_shutdown_extra_cmd }}"
 
+# Optional : if system_ansible_ssh_keys is set (to a list of public SSH keys)
+# it'll configure the keys for the ansible user. If not set, you have to configure it manually
+# or with the ssh_users / ssh_extra_users
+# system_ansible_ssh_keys: []
+
+# if set, will add the following options to the ssh keys for ansible
+system_ansible_ssh_keys_options:
+  - no-X11-forwarding
+  - no-agent-forwarding
+  - no-pty
+# If set, will restrict the ansible ssh keys to the configured IP.
+# An empty list means no restriction
+system_ansible_src_ip: []
 ...

roles/common/tasks/ansible.yml

@@ -0,0 +1,26 @@
+---
+
+- name: Deploy SSH keys for the ansible account
+  authorized_key:
+    user: ansible
+    key: "{{ system_ansible_ssh_keys | join(\"\n\") }}"
+    key_options: "{{ system_ansible_ssh_keys_options | join(',') }}"
+    exclusive: True
+  when:
+    - system_ansible_ssh_keys is defined
+    - system_ansible_ssh_keys | length > 0
+    - system_ansible_src_ip is not defined or system_ansible_src_ip | length < 1
+  tags: system
+
+- name: Deploy SSH keys for the ansible account (with source IP restriction)
+  authorized_key:
+    user: ansible
+    key: "{{ system_ansible_ssh_keys | join(\"\n\") }}"
+    key_options: "from=\"{{ system_ansible_src_ip | join(',') }}\",{{ system_ansible_ssh_keys_options | join(',') }}"
+    exclusive: True
+  when:
+    - system_ansible_ssh_keys is defined
+    - system_ansible_ssh_keys | length > 0
+    - system_ansible_src_ip is defined
+    - system_ansible_src_ip | length > 0
+  tags: system

roles/common/tasks/main.yml

@@ -17,6 +17,7 @@
     - ansible_os_family == 'RedHat'
 - include_tasks: mail.yml
 - include_tasks: system.yml
+- include_tasks: ansible.yml
 - include_tasks: hardware.yml
   when: ansible_virtualization_role == 'host'
 - include_tasks: guest.yml