---
# file: roles/common/tasks/sshd.yml

- name: ensure sshd is installed
  apt:
    name: openssh-server
    state: present
  tags:
    - ssh

- name: ensure sshd is configured (old-style)
  template:
    src: sshd_config_old_style.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: '0644'
    backup: true
    validate: '/usr/sbin/sshd -t -f %s'
  when: ansible_distribution_major_version|int(default=99) < 11
  notify:
    - restart sshd
  tags:
    - ssh

- name: ensure sshd is configured (main)
  template:
    src: sshd_config_main.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: '0644'
    backup: true
    validate: '/usr/sbin/sshd -t -f %s'
  when: ansible_distribution_major_version|int(default=99) > 10
  notify:
    - restart sshd
  tags:
    - ssh

- name: ensure sshd is configured (drop-ins)
  template:
    src: "sshd_config.d/{{ item }}.j2"
    dest: "/etc/ssh/sshd_config.d/{{ item }}"
    owner: root
    group: root
    mode: '0644'
    backup: true
    validate: '/usr/sbin/sshd -t -f %s'
  when: ansible_distribution_major_version|int(default=99) > 10
  with_items:
    - authentication.conf
    - banner.conf
    - ciphers.conf
    - forwarding.conf
    - groups.conf
  notify:
    - restart sshd
  tags:
    - ssh

- name: ensure ssh is configured (old-style)
  template:
    src: ssh_config.j2
    dest: /etc/ssh/ssh_config
    owner: root
    group: root
    mode: '0644'
    backup: true
  when: ansible_distribution_major_version|int(default=99) < 11
  tags:
    - ssh

- name: ensure ssh is configured (main)
  copy:
    src: ssh_config
    dest: /etc/ssh/ssh_config
    owner: root
    group: root
    mode: '0644'
    backup: true
  when: ansible_distribution_major_version|int(default=99) > 10
  tags:
    - ssh

- name: ensure ssh is configured (drop-ins)
  copy:
    src: "ssh_config.d/{{ item }}"
    dest: "/etc/ssh/ssh_config.d/{{ item }}"
    owner: root
    group: root
    mode: '0644'
    backup: true
  when: ansible_distribution_major_version|int(default=99) > 10
  with_items:
    - gssapi.conf
    - sshfp.conf
  tags:
    - ssh

- name: ensure standard pam configuration for sshd
  copy:
    src: pam/sshd
    dest: /etc/pam.d/sshd
    owner: root
    group: root
    mode: '0644'
  notify:
    - restart sshd
  tags:
    - ssh

- name: ensure pam creates a home directory
  command: pam-auth-update --enable mkhomedir --force
  environment:
    DEBIAN_FRONTEND: noninteractive
  when: ssh_mkhomedir
  tags:
    - ssh
    - pam

- name: ensure pam doesn't create a home directory
  command: pam-auth-update --remove mkhomedir --force
  environment:
    DEBIAN_FRONTEND: noninteractive
  when: not ssh_mkhomedir
  tags:
    - ssh
    - pam

- name: ensure sshd is running and enabled
  service:
    name: ssh
    state: started
    enabled: true
  tags:
    - ssh

- name: ensure a proper ssh environment for root
  file:
    state: directory
    path: /root/.ssh
    owner: root
    group: root
    mode: '0700'
  tags:
    - ssh
    - root

- name: Check for Proxmox SSH keys
  stat:
    path: /etc/pve/priv/authorized_keys
  register: pve_ssh_present
  tags:
    - ssh
    - root

# filename syntax: name.pub or name+dest_host_1,...,dest_host_n.pub
- name: ensure our and only our keys are authorized for root
  assemble:
    dest: >-
      {% if pve_ssh_present.stat.exists -%}
      /etc/pve/priv/authorized_keys
      {%- else -%}
      /root/.ssh/authorized_keys
      {%- endif %}
    owner: root
    group: >-
      {% if pve_ssh_present.stat.exists -%}
      www-data
      {%- else -%}
      root
      {%- endif %}
    mode: '0600'
    remote_src: false
    src: "{{ ssh_authorized_keys }}"
    backup: true
    ignore_hidden: true
    regexp: "^([^+]+|[^+]+\\+([^+]+,)*{{ inventory_hostname }}(,[^+]+)*).pub$"
  tags:
    - ssh
    - root

- name: Ensure Proxmox distributes the SSH keys
  file:
    path: /root/.ssh/authorized_keys
    src: /etc/pve/priv/authorized_keys
    state: link
  when: pve_ssh_present.stat.exists
  tags:
    - ssh
    - root

- name: ensure we fail2ban bad people
  apt:
    name: fail2ban
    state: present
  tags:
    - ssh

- name: ensure we got ourselves protected from sleepiness
  apt:
    name: molly-guard
    state: present
  tags:
    - molly
    - shell
    - ssh

- name: ensure screen does not interfere with sleepiness
  copy:
    src: molly-guard
    dest: /etc/molly-guard/rc
    owner: root
    group: root
    mode: '0644'
  tags:
    - molly
    - shell
    - ssh
