ansible-openwrt-crxn/roles/config-ssh/tasks/main.yml

---
- name: Delete old host keys
  ansible.builtin.file:
    path: "/etc/dropbear/dropbear_rsa_host_key"
    state: absent
  notify:
    - Save changes

- name: Copy host keys
  template:
    src: templates/host_key.j2
    dest: /etc/dropbear/dropbear_ed25519_host_key
    owner: root
    group: root
    mode: 0600
  notify:
    - Save changes

- name: Copy authorized keys
  template:
    src: templates/authorized_keys.j2
    dest: /etc/dropbear/authorized_keys
    owner: root
    group: root
    mode: 0600
  notify:
    - Save changes

- name: Disable password authentication
  uci:
    command: section
    config: dropbear
    type: dropbear
    find_by:
      Port: 22
    value:
      PasswordAuth: off
      RootPasswordAuth: off
  notify:
    - Save changes