initial opencode commit

roles/ssh_harden/templates/sshd-hardening.conf.j2

@@ -0,0 +1,18 @@
+# Managed by Ansible - ssh_harden role.
+# Sorted last (99-) so this wins over other drop-ins and the main config.
+
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+PermitEmptyPasswords no
+UseDNS no
+X11Forwarding no
+PrintMotd no
+MaxAuthTries {{ ssh_max_auth_tries }}
+MaxSessions 4
+LoginGraceTime 30
+ClientAliveInterval {{ ssh_client_alive_interval }}
+ClientAliveCountMax {{ ssh_client_alive_count_max }}
+{% if ssh_port != 22 %}Port {{ ssh_port }}{% endif %}
+{% if ssh_restrict_users %}AllowUsers {{ admin_user }}{% endif %}