initial opencode commit

roles/ssh_harden/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+ssh_port: 22
+ssh_restrict_users: true
+ssh_client_alive_interval: 300
+ssh_client_alive_count_max: 2
+ssh_max_auth_tries: 3
+enable_fail2ban: true

roles/ssh_harden/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: restart sshd
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted
+
+- name: restart fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: restarted

roles/ssh_harden/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+# SSH hardening: key-only auth for the admin user via a drop-in config,
+# plus fail2ban to rate-limit brute force attempts.
+
+- name: Deploy SSH server hardening drop-in
+  ansible.builtin.template:
+    src: sshd-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart sshd
+
+- name: Validate sshd configuration before restart
+  ansible.builtin.command: /usr/sbin/sshd -t
+  register: sshd_test
+  changed_when: false
+  failed_when: sshd_test.rc != 0
+
+- name: Deploy fail2ban SSH jail
+  ansible.builtin.template:
+    src: fail2ban-local.j2
+    dest: /etc/fail2ban/jail.local
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart fail2ban
+
+- name: Ensure fail2ban is running and enabled
+  ansible.builtin.systemd:
+    name: fail2ban
+    enabled: true
+    state: started
+  when: enable_fail2ban | bool

roles/ssh_harden/templates/fail2ban-local.j2

@@ -0,0 +1,11 @@
+# Managed by Ansible - ssh_harden role.
+
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+ignoreip = 127.0.0.1/8 ::1
+
+[sshd]
+enabled = true
+port = {{ ssh_port }}

roles/ssh_harden/templates/sshd-hardening.conf.j2

@@ -0,0 +1,18 @@
+# Managed by Ansible - ssh_harden role.
+# Sorted last (99-) so this wins over other drop-ins and the main config.
+
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+PermitEmptyPasswords no
+UseDNS no
+X11Forwarding no
+PrintMotd no
+MaxAuthTries {{ ssh_max_auth_tries }}
+MaxSessions 4
+LoginGraceTime 30
+ClientAliveInterval {{ ssh_client_alive_interval }}
+ClientAliveCountMax {{ ssh_client_alive_count_max }}
+{% if ssh_port != 22 %}Port {{ ssh_port }}{% endif %}
+{% if ssh_restrict_users %}AllowUsers {{ admin_user }}{% endif %}