removed ssh stuff

roles/stoat/tasks/harden.yml

@@ -34,29 +34,6 @@
   when: item.rc | int != 0
   notify: Reload firewalld
 
-# ------------------------------------------------------------
-# SSH hardening (Drop-in config, validated before restart)
-# ------------------------------------------------------------
-- name: Deploy sshd hardening drop-in
-  ansible.builtin.template:
-    src: sshd_hardening.conf.j2
-    dest: /etc/ssh/sshd_config.d/00-hardening.conf
-    owner: root
-    group: root
-    mode: "0644"
-  register: sshd_conf
-
-- name: Validate sshd configuration
-  ansible.builtin.command: sshd -t
-  changed_when: false
-  when: sshd_conf is changed
-
-- name: Restart sshd
-  ansible.builtin.service:
-    name: sshd
-    state: restarted
-  when: sshd_conf is changed
-
 # ------------------------------------------------------------
 # Fail2Ban - brute force protection
 # ------------------------------------------------------------

roles/stoat/templates/sshd_hardening.conf.j2

@@ -1,8 +0,0 @@
-# Managed by Ansible - stoat role (sshd hardening drop-in)
-# Values come from group_vars/all/vars.yml
-
-PermitRootLogin {{ sshd_permit_root_login }}
-PasswordAuthentication {{ sshd_password_authentication }}
-{% if sshd_mfa_required %}
-AuthenticationMethods publickey,keyboard-interactive:pam
-{% endif %}