add key removal facility

common/tasks/sshd.yml

@@ -4,7 +4,7 @@
 - name: ensure sshd is installed
   apt:  name=openssh-server state=latest
   tags:
-    - sshd
+    - ssh
     - packages 
 
 - name: ensure sshd configured
@@ -12,7 +12,7 @@
   notify:
     - restart sshd
   tags:
-    - sshd
+    - ssh
     - config
 
 - name: ensure home dir creation on first login
@@ -20,13 +20,13 @@
   notify:
     - restart sshd
   tags:
-    - sshd
+    - ssh
     - config
 
 - name: ensure sshd is running and enabled
   service: name=ssh state=running enabled=yes
   tags:
-    - sshd
+    - ssh
     - service
 
 - name: ensure every ssh-key is installed
@@ -34,5 +34,13 @@
   with_fileglob:
     - keys/*.pub
   tags:
-    - sshd
+    - ssh
+    - root
+
+- name: ensure old ssh-keys are removed
+  authorized_key: user=root key="{{ lookup('file', item) }}" state=absent
+  with_fileglob:
+    - keys-removed/*.pub
+  tags:
+    - ssh
     - root