removed ssh stuff

README.md

@@ -22,7 +22,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
     ├── handlers/main.yml
     └── templates/
         ├── jail.local.j2                    # fail2ban config
-        ├── sshd_hardening.conf.j2           # sshd drop-in
         └── podman-compose-stoat.service.j2  # systemd unit for the stack
 ```
 
@@ -44,11 +43,7 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
    stoat-demo ansible_host=stoat-demo ansible_user=YOUR_SSH_USER
    ```
 
-3. **SSH password login is intentionally enabled** (`sshd_password_authentication: yes`).
-   - Root login stays disabled — use your SSH user + `sudo`.
-   - Fail2Ban is the brute-force defense: `3` failed attempts → `1 h` ban (tunable).
-   - If you ever want key-only auth again, flip the var to `no`.
-   - Ansible connects with a password via `-k`:
+3. **SSH is not touched by this playbook** — the server keeps its SSH configuration exactly as you have it. Fail2Ban still protects the login (`3` failed attempts → `1 h` ban, tunable). Ansible connects with your SSH password via `-k`:
 
    ```bash
    ansible-playbook -i inventory.ini site.yml -k
@@ -62,7 +57,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
 |---|---|
 | **System** | `dnf update` all packages; install `git`, `curl`, `openssl` |
 | **Firewall** | firewalld default-deny; allow `ssh`, `http`, `https`, `7881/tcp`, `50000-50100/udp` (LiveKit voice) |
-| **SSH** | drop-in `00-hardening.conf`: `PermitRootLogin no`, `PasswordAuthentication yes`; config validated with `sshd -t` before restart |
 | **Fail2Ban** | `sshd` jail (3 retries → 1 h ban, incremental for repeat offenders) |
 | **Auto-updates** | `dnf5-plugin-automatic`, security-only, `apply_updates = yes`, started timer |
 | **Logs** | logrotate rule for fail2ban logs (daily, 7 rotations, compressed) |
@@ -94,9 +88,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
 | `stoat_service_user` | `stoat` | unprivileged user running rootless podman |
 | `podman_unprivileged_port_start` | `80` | lowest port rootless containers may bind |
 | `fail2ban_port` / `fail2ban_maxretry` / `fail2ban_bantime` | `22` / `3` / `3600` | sshd jail tuning |
-| `sshd_permit_root_login` | `no` | root SSH access |
-| `sshd_password_authentication` | `yes` | password login (fail2ban guards it) |
-| `sshd_mfa_required` | `false` | only enable if a 2FA PAM module exists, else you lock yourself out |
 | `firewall_services` / `firewall_ports` | ssh,http,https / 7881, UDP range | firewalld allow rules |
 
 Override any variable per-run, without editing files:
@@ -152,6 +143,6 @@ sudo firewall-cmd --list-all
 - **First start pulls ~2 GB of images** and initializes MongoDB — allow a few minutes; the systemd unit tolerates up to 15 min (`TimeoutStartSec=900`).
 - **Podman, not Docker**: the upstream stack is docker-compose based; this deployment runs it with `podman-compose` (rootless). It supports the compose features this stack needs (`depends_on: condition: service_healthy`, bind mounts, port ranges).
 - **`generate_config.sh` is guarded** by `creates:` — it never overwrites existing `secrets.env`/`Revolt.toml` unintentionally. To regenerate config deliberately, run it manually with `--overwrite` as the `stoat` user (after backing up secrets).
-- **Security posture**: rootless containers, non-root SSH user, fail2ban, firewalld default-deny, security-only auto-updates. (Aligned with the upstream guide's recommendations.)
+- **Security posture**: rootless containers, fail2ban, firewalld default-deny, security-only auto-updates. SSH configuration is left exactly as you set it. (Aligned with the upstream guide's recommendations.)
 - **Rootless bind mounts**: data persists in `/opt/stoat/self-hosted/data/` (mongodb, rabbitmq, minio, caddy).
 - System hardening + Stoat are one role run; to re-apply only config changes, re-running `site.yml` is idempotent.