---
# SSH hardening: key-only auth for the admin user via a drop-in config,
# plus fail2ban to rate-limit brute force attempts.

- name: Deploy SSH server hardening drop-in
  ansible.builtin.template:
    src: sshd-hardening.conf.j2
    dest: /etc/ssh/sshd_config.d/99-ansible-hardening.conf
    owner: root
    group: root
    mode: "0644"
  notify: restart sshd

- name: Validate sshd configuration before restart
  ansible.builtin.command: /usr/sbin/sshd -t
  register: sshd_test
  changed_when: false
  failed_when: sshd_test.rc != 0

- name: Deploy fail2ban SSH jail
  ansible.builtin.template:
    src: fail2ban-local.j2
    dest: /etc/fail2ban/jail.local
    owner: root
    group: root
    mode: "0644"
  notify: restart fail2ban

- name: Ensure fail2ban is running and enabled
  ansible.builtin.systemd:
    name: fail2ban
    enabled: true
    state: started
  when: enable_fail2ban | bool