remove obsolete option

bundles/ssh/files/ssh_config

@@ -1,5 +1,4 @@
 Host *
-    #UserKnownHostsFile ~/.ssh/known_hosts ~/.ssh/known_hosts.d/%k
     SendEnv LANG LC_*
     HashKnownHosts yes
     GSSAPIAuthentication yes

bundles/ssh/items.py

@@ -1,21 +1,25 @@
-if not node.metadata.get('FIXME_dont_touch_sshd', False):
-    # on debian bullseye raspberry images, starting the systemd ssh
-    # daemon seems to collide with an existing sysv daemon
-    directories = {
+# on debian bullseye raspberry images, starting the systemd ssh
+# daemon seems to collide with an existing sysv daemon
+dont_touch_sshd = node.metadata.get('FIXME_dont_touch_sshd', False),
+
+directories = {
     '/etc/ssh': {
         'purge': True,
         'mode': '0755',
+        'skip': dont_touch_sshd,
     }
-    }
+}
 
-    files = {
+files = {
     '/etc/ssh/moduli': {
         'content_type': 'any',
+        'skip': dont_touch_sshd,
     },
     '/etc/ssh/ssh_config': {
         'triggers': [
             'svc_systemd:ssh:restart'
         ],
+        'skip': dont_touch_sshd,
     },
     '/etc/ssh/ssh_config': {
         'content_type': 'mako',
@@ -24,6 +28,7 @@ if not node.metadata.get('FIXME_dont_touch_sshd', False):
         'triggers': [
             'svc_systemd:ssh:restart'
         ],
+        'skip': dont_touch_sshd,
     },
     '/etc/ssh/sshd_config': {
         'content_type': 'mako',
@@ -33,6 +38,7 @@ if not node.metadata.get('FIXME_dont_touch_sshd', False):
         'triggers': [
             'svc_systemd:ssh:restart'
         ],
+        'skip': dont_touch_sshd,
     },
     '/etc/ssh/ssh_host_ed25519_key': {
         'content': node.metadata.get('ssh/host_key/private') + '\n',
@@ -56,10 +62,11 @@ if not node.metadata.get('FIXME_dont_touch_sshd', False):
                 and other_node.has_bundle('ssh')
         ) + '\n',
     },
-    }
+}
 
-    svc_systemd['ssh'] = {
+svc_systemd['ssh'] = {
     'needs': [
         'tag:ssh_users',
     ],
-    }
+    'skip': dont_touch_sshd,
+}

bundles/ssh/metadata.py

@@ -1,3 +1,4 @@
+from ipaddress import ip_interface
 from base64 import b64decode
 
 
@@ -32,3 +33,34 @@ def host_key(metadata):
             }
         },
     }
+
+
+@metadata_reactor.provides(
+    'ssh/hostnames',
+)
+def hostnames(metadata):
+    ips = set()
+
+    for network in node.metadata.get('network').values():
+        if network.get('ipv4', None):
+            ips.add(str(ip_interface(network['ipv4']).ip))
+        if network.get('ipv6', None):
+            ips.add(str(ip_interface(network['ipv6']).ip))
+
+    domains = {
+        domain
+            for domain, records in node.metadata.get('dns').items()
+            for type, values in records.items()
+            if type in {'A', 'AAAA'}
+            and set(values) & ips
+    }
+
+    return {
+        'ssh': {
+            'hostnames': {
+                node.hostname,
+                *ips,
+                *domains,
+            }
+        },
+    }

libs/ssh.py

@@ -2,7 +2,6 @@ from base64 import b64decode, b64encode
 from hashlib import sha3_224, sha1
 from functools import cache
 import hmac
-from ipaddress import ip_interface
 
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from cryptography.hazmat.primitives.serialization import Encoding, PrivateFormat, PublicFormat, NoEncryption
@@ -57,30 +56,13 @@ def generate_ed25519_key_pair(secret):
 # - `bw debug -c 'repo.libs.ssh.known_hosts_entry_for(repo.get_node(<node with hostname 10.0.0.5>), <salt from ssh-keygen>)'`
 @cache
 def known_hosts_entry_for(node, test_salt=None):
-    ips = set()
-
-    for network in node.metadata.get('network').values():
-        if network.get('ipv4', None):
-            ips.add(str(ip_interface(network['ipv4']).ip))
-        if network.get('ipv6', None):
-            ips.add(str(ip_interface(network['ipv6']).ip))
-
-    domains = {
-        domain
-            for domain, records in node.metadata.get('dns').items()
-            for type, values in records.items()
-            if type in {'A', 'AAAA'}
-            and set(values) & ips
-    }
-
     lines = set()
 
-    for hostname in {node.hostname, *ips, *domains}:
-    
+    for hostname in sorted(node.metadata.get('ssh/hostnames')):
         if test_salt:
             salt = b64decode(test_salt)
         else:
-            salt = sha1(node.metadata.get('id').encode()).digest()
+            salt = sha1((node.metadata.get('id') + hostname).encode()).digest()
 
         hash = hmac.new(salt, hostname.encode(), sha1).digest()
         pubkey = node.metadata.get('ssh/host_key/public')