fix(ansible): ssh-ca reloads the sshd unit that is running

The netbird run (pipeline 14795) failed at the reload: 'Could not find the requested service sshd.service'. Ubuntu's service_facts list sshd.service as a not-found alias next to the real ssh.service (running; disabled because ssh.socket activates it), and the role only checked that the name exists. The unit is now the one of sshd.service/ssh.service whose state is running, asserted to be exactly one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'feat(ansible): SSH CA on netbird.renner.uno' (#1471 ) from ssh-ca-netbird into main
2026-10-27 10:41:06 +01:00 · 2026-10-27 09:37:16 +00:00 · 2026-10-27 10:36:21 +01:00 · 2026-10-27 09:33:35 +00:00 · 2026-10-27 10:31:42 +01:00 · 2026-10-27 09:25:47 +00:00
2 changed files with 20 additions and 7 deletions
@@ -75,3 +75,5 @@ claude-ws ansible_host=10.3.40.78 ansible_user=root
 # was verified.
 [ssh_ca]
 proxy-1.renner.uno
+proxy-2.renner.uno
+netbird.renner.uno
@@ -127,13 +127,24 @@
      - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective_lines"
    fail_msg: "sshd -T does not show the SSH CA settings; another config line takes precedence"

-# The unit is sshd.service on Arch and RedHat, ssh.service on Debian. sshd -T
-# only parses the files, so the running daemon is reloaded on every run; a
-# reload keeps open sessions.
+# The unit is sshd.service on Arch and RedHat, ssh.service on Debian/Ubuntu.
+# Ubuntu also lists sshd.service as a not-found alias, so the running one is
+# picked. sshd -T only parses the files, so the running daemon is reloaded on
+# every run; a reload keeps open sessions.
 - name: Read the service list
  ansible.builtin.service_facts:

- name: Reload sshd so the running daemon uses the CA config
-  ansible.builtin.systemd:
-    name: "{{ 'sshd.service' if 'sshd.service' in ansible_facts.services else 'ssh.service' }}"
-    state: reloaded
+- name: Reload the running sshd unit
+  vars:
+    ssh_ca_sshd_units: "{{ ansible_facts.services | dict2items | selectattr('key', 'in', ['sshd.service', 'ssh.service']) | selectattr('value.state', 'equalto', 'running') | map(attribute='key') | list }}"
+  block:
+    - name: Check exactly one sshd unit is running
+      ansible.builtin.assert:
+        that:
+          - ssh_ca_sshd_units | length == 1
+        fail_msg: "Expected one running sshd.service or ssh.service, found {{ ssh_ca_sshd_units }}"
+
+    - name: Reload sshd so the running daemon uses the CA config
+      ansible.builtin.systemd:
+        name: "{{ ssh_ca_sshd_units | first }}"
+        state: reloaded
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	adedc98b50	fix(ansible): ssh-ca reloads the sshd unit that is running ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details The netbird run (pipeline 14795) failed at the reload: 'Could not find the requested service sshd.service'. Ubuntu's service_facts list sshd.service as a not-found alias next to the real ssh.service (running; disabled because ssh.socket activates it), and the role only checked that the name exists. The unit is now the one of sshd.service/ssh.service whose state is running, asserted to be exactly one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:41:06 +01:00
k.renner	1f228c94ef	Merge pull request 'feat(ansible): SSH CA on netbird.renner.uno' (#1471 ) from ssh-ca-netbird into main ci/woodpecker/push/deploy-ssh-ca Pipeline failed Details Reviewed-on: #1471	2026-10-27 09:37:16 +00:00
claude-botandClaude Opus 5.5	9232937b85	feat(ansible): SSH CA on netbird.renner.uno ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details proxy-2 verified (claude-bot cert login, sudo allow/deny as on proxy-1). netbird is the first Ubuntu host (OpenSSH_9.6p1 Ubuntu-3ubuntu13.20): unit ssh.service, which the role picks from service_facts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:36:21 +01:00
k.renner	707f6ab840	Merge pull request 'feat(ansible): SSH CA on proxy-2' (#1470 ) from ssh-ca-proxy-2 into main ci/woodpecker/push/deploy-ssh-ca Pipeline was successful Details Reviewed-on: #1470	2026-10-27 09:33:35 +00:00
claude-botandClaude Opus 5.5	7600a9dbf9	feat(ansible): SSH CA on proxy-2 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details proxy-1 is verified: owner cert login as root (sk-ed25519 cert) and claude-bot cert login with the expected sudo rules both work. proxy-2 is its twin (same OpenSSH_10.6 banner). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:31:42 +01:00
k.renner	b12ef67002	Merge pull request 'fix(ansible): ssh-ca compares sshd -T output case-insensitively' (#1469 ) from ssh-ca-assert-case into main ci/woodpecker/push/deploy-ssh-ca Pipeline was successful Details Reviewed-on: #1469 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-27 09:25:47 +00:00