---
- name: "Authentication | Configure SSH authentication settings"
  notify: Restart sshd
  loop:
    - { regexp: '^#?\s*PubkeyAuthentication\s+', line: 'PubkeyAuthentication yes' }
    - { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}' }
    - { regexp: '^#?\s*PermitEmptyPasswords\s+', line: 'PermitEmptyPasswords no' }
    - { regexp: '^#?\s*ChallengeResponseAuthentication\s+', line: 'ChallengeResponseAuthentication {{ sshd_challenge_response_auth | ternary("yes", "no") }}' }
    - { regexp: '^#?\s*GSSAPIAuthentication\s+', line: 'GSSAPIAuthentication {{ sshd_gss_api_auth | ternary("yes", "no") }}' }
    - {
      regexp: '^#?\s*AuthenticationMethods\s+',
      line: "{{ 'AuthenticationMethods publickey password' if sshd_password_auth else 'AuthenticationMethods publickey' }}"
    }
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "{{ item.regexp }}"
    line: "{{ item.line }}"
    validate: /usr/sbin/sshd -t -f %s

- name: "Check if there is an SSH config forced by cloud-init"
  register: sshd_cloud_init
  ansible.builtin.stat:
    path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"

- name: "Authentication | override password authentication by cloud-init to '{{ sshd_password_auth | ternary('yes', 'no') }}'"
  when: sshd_cloud_init.stat.exists
  notify: Restart sshd
  ansible.builtin.lineinfile:
    path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
    regexp: '^#?PasswordAuthentication'
    line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}'