sshd config working

2026-09-08 16:56:50 -04:00
parent ba0572f559
commit 18233ebf74
12 changed files with 250 additions and 17 deletions
@@ -0,0 +1,135 @@
+#code: language=ansible
+
+- name: Disable link local addressing
+  ansible.builtin.lineinfile:
+    backrefs: false
+    backup: true
+    create: false
+    encoding: "utf-8"
+    firstmatch: true
+    group: root
+    insertafter: '^\[Network\]\s*$'
+    line: "LinkLocalAddressing=no"
+    mode: "0664"
+    owner: root
+    path: "/etc/systemd/network/10-cloud-init-eth0.network"
+    regexp: '^LinkLocalAddressing\s*=.*$'
+    state: present
+  notify:
+    - Restart systemd-networkd
+
+- name: Set link wait-online requirements
+  ansible.builtin.blockinfile:
+    append_newline: true
+    backup: true
+    block: |
+      [Link]
+      ActivationPolicy=always-up
+      RequiredForOnline=yes
+      RequiredFamilyForOnline=both
+    create: false
+    group: root
+    insertbefore: '^\[Network\]\s*$'
+    mode: "0664"
+    owner: root
+    path: "/etc/systemd/network/10-cloud-init-eth0.network"
+    prepend_newline: true
+    state: present
+
+- name: Disable global systemd-networkd-wait-online
+  ansible.builtin.systemd_service:
+    enabled: false
+    name: systemd-networkd-wait-online.service
+    scope: system
+    state: stopped
+
+- name: Enable instantiated systemd-networkd-wait-online
+  ansible.builtin.systemd_service:
+    enabled: true
+    name: systemd-networkd-wait-online@eth0.service
+    scope: system
+    state: started
+
+- name: Create sshd.service override directory
+  ansible.builtin.file:
+    group: root
+    mode: "0775"
+    owner: root
+    path: /etc/systemd/system/sshd.service.d
+    state: directory
+
+- name: Create sshd.service override config
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/sshd.service.d/sshd_override.conf
+    group: root
+    mode: "0664"
+    owner: root
+    remote_src: false
+    src: "{{ role_path }}/files/sshd_override.conf"
+  notify:
+    - Restart sshd
+
+- name: Configure sshd_config
+  ansible.builtin.lineinfile:
+    backrefs: false
+    create: true
+    encoding: "utf-8"
+    firstmatch: false
+    group: root
+    line: "{{ item.line }}"
+    mode: "0664"
+    owner: root
+    path: "/etc/ssh/sshd_config"
+    regexp: "{{ item.pattern }}"
+    state: present
+  loop: "{{ sshd_config_lines }}"
+  loop_control:
+    label: "{{ item.label }}"
+  notify:
+    - Restart sshd
+
+- name: Install UFW
+  community.general.pacman:
+    name:
+      - ufw
+    state: present
+    update_cache: true
+
+- name: Configure UFW IPv4 rules
+  community.general.ufw:
+    comment: "{{ item.comment }}"
+    direction: "in"
+    from_ip: "{{ item.source }}"
+    log: true
+    proto: tcp
+    rule: "allow"
+    to_ip: "{{ ipv4_address }}"
+    to_port: "22"
+  loop: "{{ sshd_ufw_ipv4_rules }}"
+  loop_control:
+    label: "{{ item.comment }}"
+
+- name: Configure UFW IPv6 rules
+  community.general.ufw:
+    comment: "{{ item.comment }}"
+    direction: "in"
+    from_ip: "{{ item.source }}"
+    log: true
+    proto: tcp
+    rule: "allow"
+    to_ip: "{{ ipv6_address }}"
+    to_port: "22"
+  loop: "{{ sshd_ufw_ipv6_rules }}"
+  loop_control:
+    label: "{{ item.comment }}"
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+
+- name: Enable and start UFW service
+  ansible.builtin.systemd_service:
+    enabled: true
+    name: ufw.service
+    scope: system
+    state: started