add sshd role

roles/sshd/tasks/authentication.yml

@@ -0,0 +1,31 @@
+---
+- name: "Authentication | Configure SSH authentication settings"
+  notify: Restart sshd
+  loop:
+    - { regexp: '^#?\s*PubkeyAuthentication\s+', line: 'PubkeyAuthentication yes' }
+    - { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ password_auth | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*PermitEmptyPasswords\s+', line: 'PermitEmptyPasswords no' }
+    - { regexp: '^#?\s*ChallengeResponseAuthentication\s+', line: 'ChallengeResponseAuthentication {{ challenge_response_auth | ternary("yes", "no") }}' }
+    - { regexp: '^#?\s*GSSAPIAuthentication\s+', line: 'GSSAPIAuthentication {{ gss_api_auth | ternary("yes", "no") }}' }
+    - {
+      regexp: '^#?\s*AuthenticationMethods\s+',
+      line: "{{ 'AuthenticationMethods publickey password' if password_auth else 'AuthenticationMethods publickey' }}"
+    }
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+    validate: /usr/sbin/sshd -t -f %s
+
+- name: "Check if there is an SSH config forced by cloud-init"
+  register: sshd_cloud_init
+  ansible.builtin.stat:
+    path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
+
+- name: "Authentication | override password authentication by cloud-init to '{{ password_auth | ternary('yes', 'no') }}'"
+  when: sshd_cloud_init.stat.exists
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
+    regexp: '^#?PasswordAuthentication'
+    line: 'PasswordAuthentication {{ password_auth | ternary("yes", "no") }}'