---
# One-time playbook to regenerate SSH host keys on existing hosts
# Usage: ansible-playbook -l "vm1,pangolin,birdnet" regenerate-ssh-keys.yml
#
# After running this playbook, you'll need to update your local known_hosts:
#   ssh-keygen -R hostname
# Or clear all affected entries and re-accept on next connection.

- name: Regenerate SSH host keys on existing hosts
  hosts: all
  become: true
  gather_facts: true

  tasks:
    - name: Remove existing SSH host keys
      file:
        path: "{{ item }}"
        state: absent
      loop:
        - /etc/ssh/ssh_host_rsa_key
        - /etc/ssh/ssh_host_rsa_key.pub
        - /etc/ssh/ssh_host_ecdsa_key
        - /etc/ssh/ssh_host_ecdsa_key.pub
        - /etc/ssh/ssh_host_ed25519_key
        - /etc/ssh/ssh_host_ed25519_key.pub
        - /etc/ssh/ssh_host_dsa_key
        - /etc/ssh/ssh_host_dsa_key.pub

    - name: Regenerate SSH host keys (Debian/Ubuntu)
      command: dpkg-reconfigure openssh-server
      when: ansible_facts['os_family'] == "Debian"

    - name: Regenerate SSH host keys (RHEL/CentOS)
      shell: |
        ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
        ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
        ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
      when: ansible_facts['os_family'] == "RedHat"

    - name: Regenerate SSH host keys (Alpine)
      shell: |
        ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
        ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
        ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
      when: ansible_facts['os_family'] == "Alpine"

    - name: Set correct permissions on private keys
      file:
        path: "{{ item }}"
        mode: '0600'
      loop:
        - /etc/ssh/ssh_host_rsa_key
        - /etc/ssh/ssh_host_ecdsa_key
        - /etc/ssh/ssh_host_ed25519_key
      ignore_errors: true

    - name: Set correct permissions on public keys
      file:
        path: "{{ item }}"
        mode: '0644'
      loop:
        - /etc/ssh/ssh_host_rsa_key.pub
        - /etc/ssh/ssh_host_ecdsa_key.pub
        - /etc/ssh/ssh_host_ed25519_key.pub
      ignore_errors: true

    - name: Restart SSH service
      service:
        name: "{{ 'ssh' if ansible_facts['os_family'] == 'Debian' else 'sshd' }}"
        state: restarted

    - name: Create marker file to indicate keys were regenerated
      file:
        path: /etc/ssh/.host_keys_regenerated
        state: touch
        mode: '0644'

    - name: Display new SSH host key fingerprints
      shell: |
        echo "=== New SSH Host Key Fingerprints for {{ inventory_hostname }} ==="
        for key in /etc/ssh/ssh_host_*_key.pub; do
          ssh-keygen -lf "$key" 2>/dev/null || true
        done
      register: fingerprints
      changed_when: false

    - name: Show fingerprints
      debug:
        msg: "{{ fingerprints.stdout_lines }}"