Pin the nodes' SSH host keys so CI can verify them

[anuveyatsu]

The first CI deploy (#317) reached SSH and failed on "Host key verification failed" -- strict host-key checking is on and a fresh runner has no cached keys, so it correctly refused an unknown host.

The keys are now pinned in infra/ansible/known_hosts, and ansible.cfg points UserKnownHostsFile at it with strict checking. This strengthens things: CI and every laptop verify against the same committed keys instead of trusting whatever each operator accepted first. The connection is already authenticated end-to-end by Cloudflare Access before SSH; this closes the last gap without turning checking off.

Public keys, safe to commit. A reprovision changes a key and fails the deploy loudly here until the file is updated -- correct, not a silent accept-new.

Verified: ansible all -m ping returned pong from both nodes through the pinned known_hosts.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Security
  • SSH connections now use strict host-key checking.
  • Added pinned host keys for staging servers, improving verification during first-time connections.
  • Host-key updates are documented for reprovisioned nodes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 891bb3c6-6678-49df-9949-13b82b1878ec

📥 Commits

Reviewing files that changed from the base of the PR and between 37dff50 and a0546c2.

📒 Files selected for processing (2)

• infra/ansible/ansible.cfg
• infra/ansible/known_hosts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Ansible now enables strict SSH host-key checking and uses a repository-provided known_hosts file. The file pins ed25519 keys for the staging and execution hosts.

Changes

SSH host-key verification

Layer / File(s)	Summary
Configure pinned host keys infra/ansible/ansible.cfg, infra/ansible/known_hosts	Ansible uses known_hosts with strict host-key checking. The new file pins ed25519 keys for ssh-staging.openbases.com and ssh-exec-staging.openbases.com.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to a0546

The pinned host-key configuration is consistent with the supported CI and developer deployment commands.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning the nodes' SSH host keys so CI can verify them.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bead/ci-deploy-pins-host-keys

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}