---
- name: Ensure OpenSSH server is installed
  ansible.builtin.package:
    name: openssh-server
    state: present

- name: Ensure SSH daemon is enabled and running
  ansible.builtin.service:
    name: sshd
    enabled: true
    state: started

- name: Backup current sshd_config
  ansible.builtin.copy:
    src: /etc/ssh/sshd_config
    dest: /etc/ssh/sshd_config.bak
    owner: root
    group: root
    mode: "0600"
    remote_src: true

- name: Harden SSH configuration
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "{{ ssh_item.regexp }}"
    line: "{{ ssh_item.line }}"
    state: present
    backrefs: yes
  loop:
    - regexp: "^#?Protocol"
      line: "Protocol {{ ssh_protocol }}"
    - regexp: "^#?PermitRootLogin"
      line: "PermitRootLogin {{ ssh_permit_root_login }}"
    - regexp: "^#?PasswordAuthentication"
      line: "PasswordAuthentication {{ ssh_password_authentication }}"
    - regexp: "^#?ChallengeResponseAuthentication"
      line: "ChallengeResponseAuthentication {{ ssh_challenge_response_authentication }}"
    - regexp: "^#?KerberosAuthentication"
      line: "KerberosAuthentication {{ ssh_kerberos_authentication }}"
    - regexp: "^#?GSSAPIAuthentication"
      line: "GSSAPIAuthentication {{ ssh_gssapi_authentication }}"
    - regexp: "^#?UsePAM"
      line: "UsePAM {{ ssh_use_pam }}"
    - regexp: "^#?X11Forwarding"
      line: "X11Forwarding {{ ssh_x11_forwarding }}"
    - regexp: "^#?AllowTcpForwarding"
      line: "AllowTcpForwarding {{ ssh_allow_tcp_forwarding }}"
    - regexp: "^#?PermitTunnel"
      line: "PermitTunnel {{ ssh_permit_tunnel }}"
    - regexp: "^#?AllowAgentForwarding"
      line: "AllowAgentForwarding {{ ssh_allow_agent_forwarding }}"
    - regexp: "^#?ClientAliveInterval"
      line: "ClientAliveInterval {{ ssh_client_alive_interval }}"
    - regexp: "^#?ClientAliveCountMax"
      line: "ClientAliveCountMax {{ ssh_client_alive_count_max }}"
    - regexp: "^#?LoginGraceTime"
      line: "LoginGraceTime {{ ssh_login_grace_time }}"
    - regexp: "^#?MaxAuthTries"
      line: "MaxAuthTries {{ ssh_max_auth_tries }}"
    - regexp: "^#?MaxSessions"
      line: "MaxSessions {{ ssh_max_sessions }}"
    - regexp: "^#?MaxStartups"
      line: "MaxStartups {{ ssh_max_startups }}"
    - regexp: "^#?Ciphers"
      line: "Ciphers {{ ssh_ciphers }}"
    - regexp: "^#?MACs"
      line: "MACs {{ ssh_macs }}"
    - regexp: "^#?KexAlgorithms"
      line: "KexAlgorithms {{ ssh_kex_algorithms }}"
    - regexp: "^#?PrintLastLog"
      line: "PrintLastLog {{ PrintLastLog }}"
    - regexp: '^\s*#?\s*AllowUsers'
      line: "AllowUsers {{ ssh_allow_users }}"
    - regexp: "^#?Banner"
      line: "Banner /etc/issue.net"
  loop_control:
    loop_var: ssh_item

- name: Restart SSH service to apply changes
  ansible.builtin.service:
    name: sshd
    state: restarted