---

- name: Verify
  hosts: all
  gather_facts: false
  any_errors_fatal: true

  tasks:
    - name: Gather service facts
      ansible.builtin.service_facts:

    - name: Ensure sshd is running
      ansible.builtin.assert:
        that:
          - ansible_facts.services['ssh.service'].state == 'running'

    - name: Ensure sshd_config syntax is OK
      ansible.builtin.command: sshd -t -f /etc/ssh/sshd_config
      changed_when: false

    - name: Ensure main parameteres are applied
      ansible.builtin.shell: |
        set -o pipefail ;
        sshd -T | egrep -i '
          ^protocol 2|
          ^permitrootlogin no|
          ^passwordauthentication no|
          ^pubkeyauthentication yes
        '
      args:
        executable: /bin/bash
      changed_when: false

    - name: Get sshd_config stats
      ansible.builtin.stat:
        path: /etc/ssh/sshd_config
      register: sshd_conf

    - name: Ensure sshd_config file is secure
      ansible.builtin.assert:
        that:
          - sshd_conf.stat.uid == 0
          - sshd_conf.stat.gid == 0
          - sshd_conf.stat.mode == '0600'

    - name: Create test user
      ansible.builtin.user:
        name: test
        create_home: true
        shell: /bin/bash

    - name: Create .ssh directory
      ansible.builtin.file:
        path: /home/test/.ssh/
        state: directory
        mode: '0700'
        owner: test
        group: test

    - name: Generate ssh keys
      community.crypto.openssh_keypair:
        path: /home/test/.ssh/id_rsa
        owner: test
        group: test
        mode: '0600'
      register: sshd_key_result

    - name: Put public key to test user
      ansible.posix.authorized_key:
        user: test
        key: "{{ sshd_key_result.public_key }}"
        state: present

    - name: Test ssh connection
      ansible.builtin.command: ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /home/test/.ssh/id_rsa test@localhost hostname
      changed_when: false