feat: Inject SSH public keys during LXC creation and switch to key-based authentication.

playbooks/create_lxc.yml

@@ -41,6 +41,7 @@
         vmid: "{{ container_id }}"
         hostname: "{{ container_name }}"
         password: "{{ ansible_password }}"
+        pubkey: "{{ my_public_keys | join('\n') }}"
         netif:
           net0: "name=eth0,gw=10.0.0.1,ip={{ container_ip_cidr }},bridge=vmbr0"
         cores: "{{ container_cores }}"
@@ -75,12 +76,8 @@
         groups: new
         ansible_host: "{{ container_ip_cidr | split('/') | first }}"
         ansible_user: root
-        ansible_ssh_pass: "{{ ansible_password }}"
+        ansible_user: root
-        # We need to ignore host key checking for the fresh container to avoid interactive prompt
+        # Removed ansible_ssh_pass - we rely on the injected key
-        ansible_ssh_common_args: '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
-
-        ansible_ssh_pass: "{{ ansible_password }}"
-        # We need to ignore host key checking for the fresh container to avoid interactive prompt
         ansible_ssh_common_args: '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
 
 - name: Secure and Configure New Container
@@ -88,14 +85,16 @@
   gather_facts: no
   vars:
     # We must explicitly use the password here because the 'new' group in inventory might not have it set
-    ansible_ssh_pass: "{{ hostvars[inventory_hostname]['ansible_ssh_pass'] | default(ansible_password) }}"
+    # We use the key for the initial root connection, NOT the password
+    # Set ansible_ssh_private_key_file if needed, otherwise it uses the agent
     ansible_user: root
+    ansible_ssh_common_args: '-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
   vars_files:
     - "../vars.yml"
   tasks:
-    - name: Wait for connection
+    # Updated to verify SSH key works, not password
-      wait_for_connection:
+    - name: Verify we can connect (ping)
-        timeout: 60
+      ping:
       
     - name: Create user '{{ target_user }}'
       ansible.builtin.user: