---
# ============================================================================
# SSH hardening
# ============================================================================
# Delivered as a drop-in under /etc/ssh/sshd_config.d/. The main
# sshd_config remains untouched so distro upgrades don't conflict and
# rollback is trivial (delete the drop-in).
#
# Some older sshd builds (Ubuntu < 20.04, Debian < 11) do not honour
# sshd_config.d/. We fall back to lineinfile on those.
# ============================================================================

- name: Check whether sshd supports the Include directive
  ansible.builtin.command:
    cmd: sshd -T
  register: sshd_test
  changed_when: false
  check_mode: false

- name: Determine if /etc/ssh/sshd_config.d/ is honoured
  ansible.builtin.stat:
    path: /etc/ssh/sshd_config.d
  register: sshd_dropin_dir

- name: Ensure /etc/ssh/sshd_config.d exists when honoured
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: sshd_dropin_dir.stat.exists

- name: Deploy SSH hardening drop-in
  ansible.builtin.template:
    src: sshd_hardening.conf.j2
    dest: /etc/ssh/sshd_config.d/10-mk-labs-hardening.conf
    owner: root
    group: root
    mode: "0644"
    validate: "sshd -t -f %s"
  when: sshd_dropin_dir.stat.exists
  notify: Restart sshd