# code: language=ansible

sshd_port: 22

sshd_user: ladmin

sshd_address_family: "{{ (ipv4_only | default(false)) | ansible.builtin.ternary('inet', 'any') }}"
sshd_required_family_for_online: "{{ (ipv4_only | default(false)) | ansible.builtin.ternary('ipv4', 'both') }}"

sshd_ipv4_config_lines:
  - label: PubkeyAuthentication
    pattern: '^\s*#*\s*PubkeyAuthentication\s*(yes|no)$'
    line: 'PubkeyAuthentication yes'
  - label: HostbasedAuthentication
    pattern: '^\s*#*\s*HostbasedAuthentication\s*(yes|no)$'
    line: 'HostbasedAuthentication no'
  - label: IgnoreUserKnownHosts
    pattern: '^\s*#*\s*IgnoreUserKnownHosts\s*(yes|no)$'
    line: 'IgnoreUserKnownHosts no'
  - label: PasswordAuthentication
    pattern: '^\s*#*\s*PasswordAuthentication\s*(yes|no)$'
    line: 'PasswordAuthentication no'
  - label: KbdInteractiveAuthentication
    pattern: '^\s*#*\s*KbdInteractiveAuthentication\s*(yes|no)$'
    line: 'KbdInteractiveAuthentication no'
  - label: KerberosAuthentication
    pattern: '^\s*#*\s*KerberosAuthentication\s*(yes|no)$'
    line: 'KerberosAuthentication no'
  - label: GSSAPIAuthentication
    pattern: '^\s*#*\s*GSSAPIAuthentication\s*(yes|no)$'
    line: 'GSSAPIAuthentication no'
  - label: UsePAM
    pattern: '^\s*#*\s*UsePAM\s*(yes|no)$'
    line: 'UsePAM yes'
  - label: PermitRootLogin
    pattern: '^\s*#*\s*PermitRootLogin\s*(yes|no|prohibit-password)$'
    line: 'PermitRootLogin no'
  - label: AddressFamily
    pattern: '^\s*#*\s*AddressFamily\s*(inet|inet6|any)$'
    line: "AddressFamily {{ sshd_address_family }}"
  - label: ListenAddress (IPv4)
    pattern: "^\\s*#*\\s*ListenAddress\\s*(0\\.0\\.0\\.0|{{ ipv4_address | replace('.', '\\.') }})$"
    line: "ListenAddress {{ ipv4_address }}"
  - label: Port
    pattern: '^\s*#*\s*Port\s*[0-9]{1,5}$'
    line: "Port {{ sshd_port }}"
  - label: AllowGroups
    pattern: '^\s*#*\s*AllowGroups\s*.*$'
    line: "AllowGroups ssh"

sshd_ipv6_config_lines:
  - label: ListenAddress (IPv6)
    pattern: "^\\s*#*\\s*ListenAddress\\s*(::|{{ ipv6_address }})$"
    line: "ListenAddress {{ ipv6_address }}"

sshd_ufw_ipv4_rules:
  - comment: SSH Clients v4
    source: 10.96.30.0/24
  - comment: SSH Servers v4
    source: 10.96.10.0/24
  - comment: SSH VPN v4
    source: 192.168.200.0/24

sshd_ufw_ipv6_rules:
  - comment: "SSH Clients v6"
    source: "2600:4040:593d:8b30::/64"
  - comment: "SSH Servers v6"
    source: "2600:4040:593d:8b10::/64"