Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

roles/ssh/README.md

@@ -0,0 +1,6 @@
+# ssh
+
+Hardens OpenSSH for key-only administration and disables root/password login.
+
+Tags: `ssh`, `hardening`.
+

roles/ssh/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+ssh_port: "{{ nbops_ssh_port }}"
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_kbd_interactive_authentication: "no"
+ssh_pubkey_authentication: "yes"
+ssh_use_dns: "no"
+ssh_x11_forwarding: "no"
+

roles/ssh/files/.gitkeep

@@ -0,0 +1 @@
+

roles/ssh/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart ssh
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+

roles/ssh/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+- name: Install OpenSSH server
+  ansible.builtin.apt:
+    name: openssh-server
+    state: present
+  tags: [ssh]
+
+- name: Configure sshd hardening
+  ansible.builtin.template:
+    src: nbops-sshd.conf.j2
+    dest: /etc/ssh/sshd_config.d/10-nbops.conf
+    owner: root
+    group: root
+    mode: "0644"
+    validate: /usr/sbin/sshd -t -f %s
+  notify: restart ssh
+  tags: [ssh, hardening]
+
+- name: Enable SSH
+  ansible.builtin.service:
+    name: ssh
+    enabled: true
+    state: started
+  tags: [ssh]
+

roles/ssh/templates/nbops-sshd.conf.j2

@@ -0,0 +1,8 @@
+Port {{ ssh_port }}
+PermitRootLogin {{ ssh_permit_root_login }}
+PasswordAuthentication {{ ssh_password_authentication }}
+KbdInteractiveAuthentication {{ ssh_kbd_interactive_authentication }}
+PubkeyAuthentication {{ ssh_pubkey_authentication }}
+UseDNS {{ ssh_use_dns }}
+X11Forwarding {{ ssh_x11_forwarding }}
+