initial opencode commit

roles/ssh_harden/templates/fail2ban-local.j2

@@ -0,0 +1,11 @@
+# Managed by Ansible - ssh_harden role.
+
+[DEFAULT]
+bantime = 1h
+findtime = 10m
+maxretry = 5
+ignoreip = 127.0.0.1/8 ::1
+
+[sshd]
+enabled = true
+port = {{ ssh_port }}

roles/ssh_harden/templates/sshd-hardening.conf.j2

@@ -0,0 +1,18 @@
+# Managed by Ansible - ssh_harden role.
+# Sorted last (99-) so this wins over other drop-ins and the main config.
+
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+PermitEmptyPasswords no
+UseDNS no
+X11Forwarding no
+PrintMotd no
+MaxAuthTries {{ ssh_max_auth_tries }}
+MaxSessions 4
+LoginGraceTime 30
+ClientAliveInterval {{ ssh_client_alive_interval }}
+ClientAliveCountMax {{ ssh_client_alive_count_max }}
+{% if ssh_port != 22 %}Port {{ ssh_port }}{% endif %}
+{% if ssh_restrict_users %}AllowUsers {{ admin_user }}{% endif %}