removed ssh stuff

.omo/run-continuation/ses_f63e23ebcffe7Q6sJKCl9W8sFt.json

@@ -1,10 +1,10 @@
 {
   "sessionID": "ses_f63e23ebcffe7Q6sJKCl9W8sFt",
-  "updatedAt": "2026-09-13T19:22:32.998Z",
+  "updatedAt": "2026-09-13T19:25:59.636Z",
   "sources": {
     "background-task": {
       "state": "idle",
-      "updatedAt": "2026-09-13T19:22:32.998Z"
+      "updatedAt": "2026-09-13T19:25:59.636Z"
     }
   }
 }

README.md

@@ -22,7 +22,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
     ├── handlers/main.yml
     └── templates/
         ├── jail.local.j2                    # fail2ban config
-        ├── sshd_hardening.conf.j2           # sshd drop-in
         └── podman-compose-stoat.service.j2  # systemd unit for the stack
 ```
 
@@ -44,11 +43,7 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
    stoat-demo ansible_host=stoat-demo ansible_user=YOUR_SSH_USER
    ```
 
-3. **SSH password login is intentionally enabled** (`sshd_password_authentication: yes`).
+3. **SSH is not touched by this playbook** — the server keeps its SSH configuration exactly as you have it. Fail2Ban still protects the login (`3` failed attempts → `1 h` ban, tunable). Ansible connects with your SSH password via `-k`:
-   - Root login stays disabled — use your SSH user + `sudo`.
-   - Fail2Ban is the brute-force defense: `3` failed attempts → `1 h` ban (tunable).
-   - If you ever want key-only auth again, flip the var to `no`.
-   - Ansible connects with a password via `-k`:
 
    ```bash
    ansible-playbook -i inventory.ini site.yml -k
@@ -62,7 +57,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
 |---|---|
 | **System** | `dnf update` all packages; install `git`, `curl`, `openssl` |
 | **Firewall** | firewalld default-deny; allow `ssh`, `http`, `https`, `7881/tcp`, `50000-50100/udp` (LiveKit voice) |
-| **SSH** | drop-in `00-hardening.conf`: `PermitRootLogin no`, `PasswordAuthentication yes`; config validated with `sshd -t` before restart |
 | **Fail2Ban** | `sshd` jail (3 retries → 1 h ban, incremental for repeat offenders) |
 | **Auto-updates** | `dnf5-plugin-automatic`, security-only, `apply_updates = yes`, started timer |
 | **Logs** | logrotate rule for fail2ban logs (daily, 7 rotations, compressed) |
@@ -94,9 +88,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm
 | `stoat_service_user` | `stoat` | unprivileged user running rootless podman |
 | `podman_unprivileged_port_start` | `80` | lowest port rootless containers may bind |
 | `fail2ban_port` / `fail2ban_maxretry` / `fail2ban_bantime` | `22` / `3` / `3600` | sshd jail tuning |
-| `sshd_permit_root_login` | `no` | root SSH access |
-| `sshd_password_authentication` | `yes` | password login (fail2ban guards it) |
-| `sshd_mfa_required` | `false` | only enable if a 2FA PAM module exists, else you lock yourself out |
 | `firewall_services` / `firewall_ports` | ssh,http,https / 7881, UDP range | firewalld allow rules |
 
 Override any variable per-run, without editing files:
@@ -152,6 +143,6 @@ sudo firewall-cmd --list-all
 - **First start pulls ~2 GB of images** and initializes MongoDB — allow a few minutes; the systemd unit tolerates up to 15 min (`TimeoutStartSec=900`).
 - **Podman, not Docker**: the upstream stack is docker-compose based; this deployment runs it with `podman-compose` (rootless). It supports the compose features this stack needs (`depends_on: condition: service_healthy`, bind mounts, port ranges).
 - **`generate_config.sh` is guarded** by `creates:` — it never overwrites existing `secrets.env`/`Revolt.toml` unintentionally. To regenerate config deliberately, run it manually with `--overwrite` as the `stoat` user (after backing up secrets).
-- **Security posture**: rootless containers, non-root SSH user, fail2ban, firewalld default-deny, security-only auto-updates. (Aligned with the upstream guide's recommendations.)
+- **Security posture**: rootless containers, fail2ban, firewalld default-deny, security-only auto-updates. SSH configuration is left exactly as you set it. (Aligned with the upstream guide's recommendations.)
 - **Rootless bind mounts**: data persists in `/opt/stoat/self-hosted/data/` (mongodb, rabbitmq, minio, caddy).
 - System hardening + Stoat are one role run; to re-apply only config changes, re-running `site.yml` is idempotent.

roles/stoat/tasks/harden.yml

@@ -34,29 +34,6 @@
   when: item.rc | int != 0
   notify: Reload firewalld
 
-# ------------------------------------------------------------
-# SSH hardening (Drop-in config, validated before restart)
-# ------------------------------------------------------------
-- name: Deploy sshd hardening drop-in
-  ansible.builtin.template:
-    src: sshd_hardening.conf.j2
-    dest: /etc/ssh/sshd_config.d/00-hardening.conf
-    owner: root
-    group: root
-    mode: "0644"
-  register: sshd_conf
-
-- name: Validate sshd configuration
-  ansible.builtin.command: sshd -t
-  changed_when: false
-  when: sshd_conf is changed
-
-- name: Restart sshd
-  ansible.builtin.service:
-    name: sshd
-    state: restarted
-  when: sshd_conf is changed
-
 # ------------------------------------------------------------
 # Fail2Ban - brute force protection
 # ------------------------------------------------------------

roles/stoat/templates/sshd_hardening.conf.j2

@@ -1,8 +0,0 @@
-# Managed by Ansible - stoat role (sshd hardening drop-in)
-# Values come from group_vars/all/vars.yml
-
-PermitRootLogin {{ sshd_permit_root_login }}
-PasswordAuthentication {{ sshd_password_authentication }}
-{% if sshd_mfa_required %}
-AuthenticationMethods publickey,keyboard-interactive:pam
-{% endif %}