Add systemd ephemeral authorized_keys to the instantiated service file on Fedora

Based on the following Fedora change pulling the systemd upstream
service file:

https://src.fedoraproject.org/rpms/openssh/pull-request/101
Signed-off-by: Jakub Jelen <jjelen@redhat.com>

Author: Jakuje

templates/sshd@.service.j2

@@ -24,15 +24,23 @@ EnvironmentFile=-{{ file }}
 {%   endfor %}
 {% endif %}
 ExecStart=-{{ sshd_binary }} -i
-{%- for var in __sshd_environment_variable %} ${{ var }}{% endfor %} -f
-{%- if sshd_main_config_file is not none and sshd_config_file | dirname == sshd_main_config_file ~ '.d' %}
-{{- sshd_main_config_file }}
-{% else %}
-{{- sshd_config_file }}
+{%- for var in __sshd_environment_variable %} ${{ var }}{% endfor -%}
+{%- if sshd_main_config_file is not none and sshd_config_file != sshd_main_config_file %}
+ -f {% if and sshd_config_file | dirname == sshd_main_config_file ~ '.d' %}
+{{   sshd_main_config_file -}}
+{%- else -%}
+{{   sshd_config_file -}}
+{%- endif -%}
+{%- endif -%}
+{%- if __sshd_service_ephemeral_authorized_keys %}
+ -o "AuthorizedKeysFile ${CREDENTIALS_DIRECTORY}/ssh.ephemeral-authorized_keys-all .ssh/authorized_keys"
 {% endif %}
 StandardInput=socket
 {% if __sshd_runtime_directory is not none %}
 RuntimeDirectory={{ __sshd_runtime_directory }}
 RuntimeDirectoryPreserve=yes
 RuntimeDirectoryMode={{ __sshd_runtime_directory_mode }}
 {% endif %}
+{% if __sshd_service_ephemeral_authorized_keys %}
+ImportCredential=ssh.ephemeral-authorized_keys-all
+{% endif %}

vars/Fedora.yml

@@ -32,3 +32,4 @@ __sshd_service_wants:
   - sshd-keygen.target
   - ssh-host-keys-migration.service
 __sshd_service_restart_timeout: 42s
+__sshd_service_ephemeral_authorized_keys: "{{ ansible_facts['distribution_version'] is version('43', '>=') }}"

vars/main.yml

@@ -87,6 +87,9 @@ __sshd_service_wants: ~
 # The systemd service RestartSec directive
 __sshd_service_restart_timeout: ~
 
+# Plug the systemd ephemeral authorized keys to the instantiated service file
+__sshd_service_ephemeral_authorized_keys: false
+
 # The systemd socket file does not accept the connection
 __sshd_socket_accept: true