From 1d0676f71ba00e4cfc61bb9b24ce0fbc70b34fd9 Mon Sep 17 00:00:00 2001
From: Alexander Gorelyshev <corvus-migratorius@proton.me>
Date: Mon, 18 May 2026 21:05:16 +0400
Subject: [PATCH] Add support for `AllowGroups`

---
 roles/sshd/tasks/main.yml       | 12 +++---------
 roles/sshd/tasks/whitelists.yml | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 9 deletions(-)
 create mode 100644 roles/sshd/tasks/whitelists.yml

diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index ab6d06d..f567900 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -14,6 +14,9 @@
 - name: "Configure additional restrictions"
   ansible.builtin.include_tasks: "restrictions.yml"
 
+- name: "Configure whitelists"
+  ansible.builtin.include_tasks: "whitelists.yml"
+
 - name: "Log at VERBOSE level"
   notify: Restart sshd
   ansible.builtin.lineinfile:
@@ -21,12 +24,3 @@
     regexp: '^#?LogLevel'
     line: 'LogLevel VERBOSE'
     validate: sshd -f %s -t
-
-- name: "Configure AllowUsers"
-  when: sshd_allow_users is defined
-  notify: Restart sshd
-  ansible.builtin.lineinfile:
-    path: /etc/ssh/sshd_config
-    regexp: '^#?\s*AllowUsers\s+'
-    line: "AllowUsers {{ sshd_allow_users }}"
-    validate: sshd -f %s -t
diff --git a/roles/sshd/tasks/whitelists.yml b/roles/sshd/tasks/whitelists.yml
new file mode 100644
index 0000000..3952302
--- /dev/null
+++ b/roles/sshd/tasks/whitelists.yml
@@ -0,0 +1,18 @@
+---
+- name: "Configure AllowUsers"
+  when: sshd_allow_users is defined
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?\s*AllowUsers\s+'
+    line: "AllowUsers {{ sshd_allow_users }}"
+    validate: sshd -f %s -t
+
+- name: "Configure AllowGroups"
+  when: sshd_allow_groups is defined
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?\s*AllowGroups\s+'
+    line: "AllowGroups {{ sshd_allow_groups }}"
+    validate: sshd -f %s -t