---
- name: Deploy sshd_config
  ansible.builtin.template:
    src: sshd_config.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: "0600"
    validate: "/usr/sbin/sshd -t -f %s"
  notify: restart sshd
  tags: [ssh_hardening]

- name: Create sshd_config.d drop-in directory for future exceptions
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  tags: [ssh_hardening]

- name: Enable and start sshd
  ansible.builtin.systemd:
    name: sshd
    enabled: true
    state: started
  tags: [ssh_hardening]