tests: Verify we can generate hostkeys and prevent its creation if needed

tests/tests_hostkeys.yml

@@ -0,0 +1,58 @@
+---
+- hosts: all
+  tasks:
+  - name: Remove host key before the test
+    file:
+      path: /tmp/ssh_host_ed25519_key
+      state: absent
+
+  - name: Configure sshd with alternative host keys
+    include_role:
+      name: ansible-sshd
+    vars:
+      # very BAD example
+      sshd_hostkey_owner: "nobody"
+      sshd_hostkey_group: "nobody"
+      sshd_hostkey_mode: "0664"
+      sshd:
+        HostKey:
+          - /tmp/ssh_host_ed25519_key
+
+  - name: Verify the options are correctly set
+    vars:
+      main_sshd_config: >-
+        {{
+          "/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
+          if ansible_facts['distribution'] == 'Fedora'
+          else "/etc/ssh/sshd_config"
+        }}
+    block:
+      - meta: flush_handlers
+
+      - name: Print current configuration file
+        slurp:
+          src: "{{ main_sshd_config }}"
+        register: config
+
+      - stat:
+          path: /tmp/ssh_host_ed25519_key
+        register: privkey
+
+      - stat:
+          path: /tmp/ssh_host_ed25519_key.pub
+        register: pubkey
+
+      - name: Check the options are in configuration file
+        assert:
+          that:
+            - "'HostKey /tmp/ssh_host_ed25519_key' in config.content | b64decode"
+
+      - name: Check the generated host key has requested properties
+        assert:
+          that:
+            - privkey.stat.exists
+            - privkey.stat.gr_name == 'nobody'
+            - privkey.stat.pw_name == 'nobody'
+            - privkey.stat.mode == '0664'
+            - pubkey.stat.exists
+    tags: tests::verify

tests/tests_hostkeys_missing.yml

@@ -0,0 +1,33 @@
+---
+- hosts: all
+  tasks:
+  - name: Configure sshd with missing host keys and prevent their creation
+    block:
+      - name: Configure missing hostkey
+        include_role:
+          name: ansible-sshd
+        vars:
+          sshd_verify_hostkeys: []
+          sshd:
+            HostKey:
+              - /tmp/missing_ssh_host_rsa_key
+        register: role_result
+
+      - name: unreachable task
+        fail:
+          msg: UNREACH
+
+    rescue:
+      - name: Check that we failed in the role
+        assert:
+          that:
+            - ansible_failed_result.msg != 'UNREACH'
+            - not role_result.changed
+          msg: "Role has not failed when it should have"
+
+      - name: Make sure service is still running
+        service:
+          name: sshd
+          state: started
+        register: result
+        failed_when: result.changed