hac/ansible/roles/sshd/tasks/main.yml

---
- name: Disable Password Authentication
  ansible.builtin.lineinfile:
    dest: /etc/ssh/sshd_config
    regexp: '^PasswordAuthentication'
    line: "PasswordAuthentication no"
    state: present
    backup: true
  notify:
    - Restart SSH

- name: Disable Root Login
  ansible.builtin.lineinfile:
    dest: /etc/ssh/sshd_config
    regexp: '^PermitRootLogin'
    line: "PermitRootLogin no"
    state: present
    backup: true
  notify:
    - Restart SSH

- name: Restrict host key
  ansible.builtin.lineinfile:
    dest: /etc/ssh/sshd_config
    regexp: '#HostKey /etc/ssh/ssh_host_ed25519_key'
    line: "HostKey /etc/ssh/ssh_host_ed25519_key"
    state: present
    backup: true
  notify:
    - Restart SSH

- name: Configure sshd
  ansible.builtin.copy:
    src: "crypto.conf"
    dest: "/etc/ssh/sshd_config.d/"
    owner: root
    group: root
    mode: "0640"
  notify:
    - Restart SSH