---
- name: Playbook to deny ssh for plesk servers that do not have shell users
  hosts: all
  gather_facts: false
  tasks:
    - name: Get server info
      plesk_info:
      register: plsk
    - name: On plesk server run the script
      when: plsk.plesk_found
      ansible.builtin.shell: |
        set -o pipefail
        set -e
        homedirs=$(awk '/HTTPD_VHOSTS_D/ {print $2}' /etc/psa/psa.conf)
        bashes=$(grep "$homedirs" /etc/passwd | grep -v "/bin/false" | wc -l)
        if [ "$bashes" -eq 0 ]; then
          rule_id=$(/usr/sbin/plesk ext firewall --list-json | jq -r '.[] | select(.class=="ssh") | .id')
          if [ -n "$rule_id" ]; then
            echo "Blocking SSH via Plesk firewall (rule ID: $rule_id)..."
            /usr/sbin/plesk ext firewall --set-rule -id "$rule_id" -action deny && /usr/sbin/plesk ext firewall --apply -auto-confirm-this-may-lock-me-out-of-the-server
          else
            echo "SSH rule not found in firewall!"
          fi
        else
          echo "We have users with shells, skipping"
        fi
      args:
        executable: /bin/bash
      register: script_result
      changed_when: "'Blocking SSH' in script_result.stdout"
      failed_when: false
    - name: Display results
      ansible.builtin.debug:
        msg: "{{ script_result.stdout_lines }}"