dotfiles/roles/sshd/tasks/main.yml

---
- name: Packages
  ansible.builtin.include_tasks: install.yml
  tags: install

- name: Set sshd systemd unit for Ubuntu
  ansible.builtin.set_fact:
    system_sshd_unit: ssh
  when: ansible_distribution == "Ubuntu"

- name: Set sshd systemd unit for co-Ubuntu
  ansible.builtin.set_fact:
    system_sshd_unit: sshd
  when: ansible_distribution != "Ubuntu"

- name: Enable SSH server
  ansible.builtin.service:
    name: "{{ system_sshd_unit }}"
    enabled: true

- name: Harden the SSH config
  ansible.builtin.template:
    src: templates/10-harden.conf
    dest: /etc/ssh/sshd_config.d/10-harden.conf
    mode: 0600
    owner: root
    group: root
  notify: "Restart SSH server"

- name: Notify SELinux about new port
  community.general.seport:
    ports: "{{ sshd_port }}"
    proto: "tcp"
    setype: "ssh_port_t"
    state: "present"
  when: ansible_facts.selinux.status == 'enabled'

- name: Enable the new SSH port on firewall
  ansible.posix.firewalld:
    port: "{{ sshd_port }}/tcp"
    immediate: true
    permanent: true
    state: enabled
  notify: "Restart SSH server"
  tags: firewall

- name: Disable the default SSH port
  ansible.posix.firewalld:
    service: ssh
    permanent: true
    state: disabled
  tags: firewall

- name: Set trusted CA
  ansible.builtin.include_tasks: trusted_ca.yml
  when: sshd_auth_trusted_ca