ssh.yml

---

- name: Load vars
  hosts: all
  gather_facts: no
  tasks:
    - import_tasks: tasks/import_user_vars.yml

- name: Add SSH keys
  hosts: all
  gather_facts: yes
  vars_files:
    - files/secrets/secrets.yml
  vars:
    - ansible_become_pass: "{{ sudo_password }}"
  tasks:
    - import_tasks: tasks/import_os_vars.yml

    - name: SSH | Ensure sudo group exists
      become: yes
      group:
        name: sudo
        state: present
    
    - name: SSH | Ensure user exists
      become: yes
      user:
        name: "{{ ansible_user }}"
        group: sudo
        generate_ssh_key: yes
        shell: "/bin/bash"
        state: present

    - name: SSH | Ensure ~/.ssh directory exists
      become: yes
      file:
        path: /home/{{ ansible_user }}/.ssh
        state: directory
        owner: "{{ ansible_user }}"
        mode: 0700

    - name: SSH | Allow Access
      become: yes
      authorized_key:
        user: "{{ ansible_user }}"
        state: present
        key: "{{ lookup('file', public_key_file) }}"

    - name: SSH | Remove require tty
      become: yes
      lineinfile:
        regexp: "requiretty"
        dest: "{{ item }}"
        state: absent
      with_items:
        - /etc/sudoers
        - /etc/sudoers.d/os_defaults
  
    - name: SSH | Disable password-based authentication
      become: yes
      lineinfile:
        line: "{{ item.line }}"
        dest: /etc/ssh/sshd_config
        state: "{{ item.state }}"
      with_items:
        - { line: "PasswordAuthentication no", state: "present" }
        - { line: "PasswordAuthentication yes", state: "absent" }
        - { line: "PubkeyAuthentication yes", state: "present" }
        - { line: "ChallengeResponseAuthentication no", state: "present" }
      notify: SSH Reload
  
  handlers:
    - name: SSH Reload
      become: yes
      systemd:
        name: sshd
        state: reloaded