Sudoers config and hostname config working

roles/sshd/handlers/main.yml

@@ -1,4 +1,4 @@
-#code: language=ansible
+# code: language=ansible
 
 - name: Restart sshd
   ansible.builtin.systemd_service:
@@ -11,4 +11,4 @@
   ansible.builtin.systemd_service:
     name: systemd-networkd.service
     scope: system
-    state: restarted    
+    state: restarted

roles/sshd/tasks/main.yml

@@ -1,4 +1,4 @@
-#code: language=ansible
+# code: language=ansible
 
 - name: Disable link local addressing
   ansible.builtin.lineinfile:
@@ -26,7 +26,7 @@
       [Link]
       ActivationPolicy=always-up
       RequiredForOnline=yes
-      RequiredFamilyForOnline=both
+      RequiredFamilyForOnline={{ sshd_required_family_for_online }}
     create: false
     group: root
     insertbefore: '^\[Network\]\s*$'
@@ -69,7 +69,23 @@
   notify:
     - Restart sshd
 
-- name: Configure sshd_config
+- name: Add an ssh group
+  ansible.builtin.group:
+    local: false
+    name: ssh
+    state: present
+    system: true
+
+- name: Add user to ssh group
+  ansible.builtin.user:
+    append: true
+    groups:
+      - ssh
+    local: false
+    name: "{{ sshd_user }}"
+    state: present
+
+- name: Configure sshd_config (IPv4)
   ansible.builtin.lineinfile:
     backrefs: false
     create: true
@@ -82,7 +98,28 @@
     path: "/etc/ssh/sshd_config"
     regexp: "{{ item.pattern }}"
     state: present
-  loop: "{{ sshd_config_lines }}"
+  loop: "{{ sshd_ipv4_config_lines }}"
+  loop_control:
+    label: "{{ item.label }}"
+  notify:
+    - Restart sshd
+
+- name: Configure sshd_config (IPv6)
+  when:
+    - not (ipv4_only | default(false))
+  ansible.builtin.lineinfile:
+    backrefs: false
+    create: true
+    encoding: "utf-8"
+    firstmatch: false
+    group: root
+    line: "{{ item.line }}"
+    mode: "0664"
+    owner: root
+    path: "/etc/ssh/sshd_config"
+    regexp: "{{ item.pattern }}"
+    state: present
+  loop: "{{ sshd_ipv6_config_lines }}"
   loop_control:
     label: "{{ item.label }}"
   notify:
@@ -110,6 +147,8 @@
     label: "{{ item.comment }}"
 
 - name: Configure UFW IPv6 rules
+  when:
+    - not (ipv4_only | default(false))
   community.general.ufw:
     comment: "{{ item.comment }}"
     direction: "in"

roles/sshd/vars/main.yml

@@ -1,8 +1,13 @@
-#code: language=ansible
+# code: language=ansible
 
 sshd_port: 22
 
-sshd_config_lines:
+sshd_user: ladmin
+
+sshd_address_family: "{{ (ipv4_only | default(false)) | ansible.builtin.ternary('inet', 'any') }}"
+sshd_required_family_for_online: "{{ (ipv4_only | default(false)) | ansible.builtin.ternary('ipv4', 'both') }}"
+
+sshd_ipv4_config_lines:
   - label: PubkeyAuthentication
     pattern: '^\s*#*\s*PubkeyAuthentication\s*(yes|no)$'
     line: 'PubkeyAuthentication yes'
@@ -29,19 +34,24 @@ sshd_config_lines:
     line: 'UsePAM yes'
   - label: PermitRootLogin
     pattern: '^\s*#*\s*PermitRootLogin\s*(yes|no|prohibit-password)$'
-    line: 'PermitRootLogin prohibit-password'
+    line: 'PermitRootLogin no'
   - label: AddressFamily
     pattern: '^\s*#*\s*AddressFamily\s*(inet|inet6|any)$'
-    line: 'AddressFamily any'
+    line: "AddressFamily {{ sshd_address_family }}"
   - label: ListenAddress (IPv4)
     pattern: "^\\s*#*\\s*ListenAddress\\s*(0\\.0\\.0\\.0|{{ ipv4_address | replace('.', '\\.') }})$"
     line: "ListenAddress {{ ipv4_address }}"
-  - label: ListenAddress (IPv6)
-    pattern: "^\\s*#*\\s*ListenAddress\\s*(::|{{ ipv6_address}})$"
-    line: "ListenAddress {{ ipv6_address }}"
   - label: Port
     pattern: '^\s*#*\s*Port\s*[0-9]{1,5}$'
     line: "Port {{ sshd_port }}"
+  - label: AllowGroups
+    pattern: '^\s*#*\s*AllowGroups\s*.*$'
+    line: "AllowGroups ssh"
+
+sshd_ipv6_config_lines:
+  - label: ListenAddress (IPv6)
+    pattern: "^\\s*#*\\s*ListenAddress\\s*(::|{{ ipv6_address }})$"
+    line: "ListenAddress {{ ipv6_address }}"
 
 sshd_ufw_ipv4_rules:
   - comment: SSH Clients v4
@@ -55,4 +65,4 @@ sshd_ufw_ipv6_rules:
   - comment: "SSH Clients v6"
     source: "2600:4040:593d:8b30::/64"
   - comment: "SSH Servers v6"
-    source: "2600:4040:593d:8b10::/64"
+    source: "2600:4040:593d:8b10::/64"