initial opencode commit

roles/ssh_harden/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+# SSH hardening: key-only auth for the admin user via a drop-in config,
+# plus fail2ban to rate-limit brute force attempts.
+
+- name: Deploy SSH server hardening drop-in
+  ansible.builtin.template:
+    src: sshd-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart sshd
+
+- name: Validate sshd configuration before restart
+  ansible.builtin.command: /usr/sbin/sshd -t
+  register: sshd_test
+  changed_when: false
+  failed_when: sshd_test.rc != 0
+
+- name: Deploy fail2ban SSH jail
+  ansible.builtin.template:
+    src: fail2ban-local.j2
+    dest: /etc/fail2ban/jail.local
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart fail2ban
+
+- name: Ensure fail2ban is running and enabled
+  ansible.builtin.systemd:
+    name: fail2ban
+    enabled: true
+    state: started
+  when: enable_fail2ban | bool