sshd config working

roles/sshd/files/sshd_override.conf

@@ -0,0 +1,3 @@
+[Unit]
+Wants=network-online.target
+After=network-online.target

roles/sshd/handlers/main.yml

@@ -0,0 +1,14 @@
+#code: language=ansible
+
+- name: Restart sshd
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+    name: sshd.service
+    scope: system
+    state: restarted
+
+- name: Restart systemd-networkd
+  ansible.builtin.systemd_service:
+    name: systemd-networkd.service
+    scope: system
+    state: restarted    

roles/sshd/tasks/main.yml

@@ -0,0 +1,135 @@
+#code: language=ansible
+
+- name: Disable link local addressing
+  ansible.builtin.lineinfile:
+    backrefs: false
+    backup: true
+    create: false
+    encoding: "utf-8"
+    firstmatch: true
+    group: root
+    insertafter: '^\[Network\]\s*$'
+    line: "LinkLocalAddressing=no"
+    mode: "0664"
+    owner: root
+    path: "/etc/systemd/network/10-cloud-init-eth0.network"
+    regexp: '^LinkLocalAddressing\s*=.*$'
+    state: present
+  notify:
+    - Restart systemd-networkd
+
+- name: Set link wait-online requirements
+  ansible.builtin.blockinfile:
+    append_newline: true
+    backup: true
+    block: |
+      [Link]
+      ActivationPolicy=always-up
+      RequiredForOnline=yes
+      RequiredFamilyForOnline=both
+    create: false
+    group: root
+    insertbefore: '^\[Network\]\s*$'
+    mode: "0664"
+    owner: root
+    path: "/etc/systemd/network/10-cloud-init-eth0.network"
+    prepend_newline: true
+    state: present
+
+- name: Disable global systemd-networkd-wait-online
+  ansible.builtin.systemd_service:
+    enabled: false
+    name: systemd-networkd-wait-online.service
+    scope: system
+    state: stopped
+
+- name: Enable instantiated systemd-networkd-wait-online
+  ansible.builtin.systemd_service:
+    enabled: true
+    name: systemd-networkd-wait-online@eth0.service
+    scope: system
+    state: started
+
+- name: Create sshd.service override directory
+  ansible.builtin.file:
+    group: root
+    mode: "0775"
+    owner: root
+    path: /etc/systemd/system/sshd.service.d
+    state: directory
+
+- name: Create sshd.service override config
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/sshd.service.d/sshd_override.conf
+    group: root
+    mode: "0664"
+    owner: root
+    remote_src: false
+    src: "{{ role_path }}/files/sshd_override.conf"
+  notify:
+    - Restart sshd
+
+- name: Configure sshd_config
+  ansible.builtin.lineinfile:
+    backrefs: false
+    create: true
+    encoding: "utf-8"
+    firstmatch: false
+    group: root
+    line: "{{ item.line }}"
+    mode: "0664"
+    owner: root
+    path: "/etc/ssh/sshd_config"
+    regexp: "{{ item.pattern }}"
+    state: present
+  loop: "{{ sshd_config_lines }}"
+  loop_control:
+    label: "{{ item.label }}"
+  notify:
+    - Restart sshd
+
+- name: Install UFW
+  community.general.pacman:
+    name:
+      - ufw
+    state: present
+    update_cache: true
+
+- name: Configure UFW IPv4 rules
+  community.general.ufw:
+    comment: "{{ item.comment }}"
+    direction: "in"
+    from_ip: "{{ item.source }}"
+    log: true
+    proto: tcp
+    rule: "allow"
+    to_ip: "{{ ipv4_address }}"
+    to_port: "22"
+  loop: "{{ sshd_ufw_ipv4_rules }}"
+  loop_control:
+    label: "{{ item.comment }}"
+
+- name: Configure UFW IPv6 rules
+  community.general.ufw:
+    comment: "{{ item.comment }}"
+    direction: "in"
+    from_ip: "{{ item.source }}"
+    log: true
+    proto: tcp
+    rule: "allow"
+    to_ip: "{{ ipv6_address }}"
+    to_port: "22"
+  loop: "{{ sshd_ufw_ipv6_rules }}"
+  loop_control:
+    label: "{{ item.comment }}"
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+
+- name: Enable and start UFW service
+  ansible.builtin.systemd_service:
+    enabled: true
+    name: ufw.service
+    scope: system
+    state: started

roles/sshd/vars/main.yml

@@ -0,0 +1,58 @@
+#code: language=ansible
+
+sshd_port: 22
+
+sshd_config_lines:
+  - label: PubkeyAuthentication
+    pattern: '^\s*#*\s*PubkeyAuthentication\s*(yes|no)$'
+    line: 'PubkeyAuthentication yes'
+  - label: HostbasedAuthentication
+    pattern: '^\s*#*\s*HostbasedAuthentication\s*(yes|no)$'
+    line: 'HostbasedAuthentication no'
+  - label: IgnoreUserKnownHosts
+    pattern: '^\s*#*\s*IgnoreUserKnownHosts\s*(yes|no)$'
+    line: 'IgnoreUserKnownHosts no'
+  - label: PasswordAuthentication
+    pattern: '^\s*#*\s*PasswordAuthentication\s*(yes|no)$'
+    line: 'PasswordAuthentication no'
+  - label: KbdInteractiveAuthentication
+    pattern: '^\s*#*\s*KbdInteractiveAuthentication\s*(yes|no)$'
+    line: 'KbdInteractiveAuthentication no'
+  - label: KerberosAuthentication
+    pattern: '^\s*#*\s*KerberosAuthentication\s*(yes|no)$'
+    line: 'KerberosAuthentication no'
+  - label: GSSAPIAuthentication
+    pattern: '^\s*#*\s*GSSAPIAuthentication\s*(yes|no)$'
+    line: 'GSSAPIAuthentication no'
+  - label: UsePAM
+    pattern: '^\s*#*\s*UsePAM\s*(yes|no)$'
+    line: 'UsePAM yes'
+  - label: PermitRootLogin
+    pattern: '^\s*#*\s*PermitRootLogin\s*(yes|no|prohibit-password)$'
+    line: 'PermitRootLogin prohibit-password'
+  - label: AddressFamily
+    pattern: '^\s*#*\s*AddressFamily\s*(inet|inet6|any)$'
+    line: 'AddressFamily any'
+  - label: ListenAddress (IPv4)
+    pattern: "^\\s*#*\\s*ListenAddress\\s*(0\\.0\\.0\\.0|{{ ipv4_address | replace('.', '\\.') }})$"
+    line: "ListenAddress {{ ipv4_address }}"
+  - label: ListenAddress (IPv6)
+    pattern: "^\\s*#*\\s*ListenAddress\\s*(::|{{ ipv6_address}})$"
+    line: "ListenAddress {{ ipv6_address }}"
+  - label: Port
+    pattern: '^\s*#*\s*Port\s*[0-9]{1,5}$'
+    line: "Port {{ sshd_port }}"
+
+sshd_ufw_ipv4_rules:
+  - comment: SSH Clients v4
+    source: 10.96.30.0/24
+  - comment: SSH Servers v4
+    source: 10.96.10.0/24
+  - comment: SSH VPN v4
+    source: 192.168.200.0/24
+
+sshd_ufw_ipv6_rules:
+  - comment: "SSH Clients v6"
+    source: "2600:4040:593d:8b30::/64"
+  - comment: "SSH Servers v6"
+    source: "2600:4040:593d:8b10::/64"