---
- name: Install OpenSSH server
  ansible.builtin.apt:
    name: openssh-server
    state: present
  tags: [ssh]

- name: Configure sshd hardening
  ansible.builtin.template:
    src: nbops-sshd.conf.j2
    dest: /etc/ssh/sshd_config.d/10-nbops.conf
    owner: root
    group: root
    mode: "0644"
    validate: /usr/sbin/sshd -t -f %s
  notify: restart ssh
  tags: [ssh, hardening]

- name: Enable SSH
  ansible.builtin.service:
    name: ssh
    enabled: true
    state: started
  tags: [ssh]