server_ssh: do not overwrite existing user ca if not managed by ansible

Only one key is managed by Ansible at time, if not-managed keys are
present in user_ca.pub they are not removed, but the new key is
appended to the file.

If the ansible-managed key is changed it is overwritten.
The ansible-managed key is detected using a leadind tag in the key
line in user_ca.pub.

Maybe it would be best to have a "key" version parameter and variable
with options to enable key rotation/revocation.

Anyway it provides an easy way to push new user ca while machine already
configured with previous version of this role will still accept login
from user with certificate issued from the older cas.

Author: Lorenzo Zolfanelli

roles/ssh_server/tasks/main.yaml

@@ -12,10 +12,12 @@
   set_fact:
     user_ca_key: "{{ lookup('file', 'lilik_ca_s1.pub') }}"
 
-- name: Update container user CA key
-  copy:
-    content: "{{ user_ca_key }}"
+- name: Update container user CA cert
+  lineinfile:
+    line: "{{ user_ca_key }} +AnsibleManaged_CA_cert"
+    regexp: " \+AnsibleManaged_CA_cert"
     dest: "/etc/ssh/user_ca.pub"
+    create: yes
   notify: restart ssh
 
 - name: Validate SSH host certificate if any