---
- name: "Configure AllowUsers"
  when: sshd_allow_users is defined
  notify: Restart sshd
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?\s*AllowUsers\s+'
    line: "AllowUsers {{ sshd_allow_users }}"
    validate: sshd -f %s -t

- name: "Configure AllowGroups"
  when: sshd_allow_groups is defined
  notify: Restart sshd
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?\s*AllowGroups\s+'
    line: "AllowGroups {{ sshd_allow_groups }}"
    validate: sshd -f %s -t