From e8376ee112a35a1722dad3ead1e100089db132d2 Mon Sep 17 00:00:00 2001
From: Alexander Gorelyshev <corvus-migratorius@proton.me>
Date: Mon, 18 May 2026 20:10:12 +0400
Subject: [PATCH] Add a task for optionally configuring the `AllowUsers`
 directive

---
 roles/sshd/tasks/main.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index d35222a..ab6d06d 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -21,3 +21,12 @@
     regexp: '^#?LogLevel'
     line: 'LogLevel VERBOSE'
     validate: sshd -f %s -t
+
+- name: "Configure AllowUsers"
+  when: sshd_allow_users is defined
+  notify: Restart sshd
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?\s*AllowUsers\s+'
+    line: "AllowUsers {{ sshd_allow_users }}"
+    validate: sshd -f %s -t