---
- name: Playbook to make sshd changes
  hosts: all
  gather_facts: false
  vars:
    sshd_config_path: /etc/ssh/sshd_config
    sshd_hardening_params:
      - {regexp: '^#?AllowAgentForwarding', line: 'AllowAgentForwarding no'}
      - {regexp: '^#?AllowTcpForwarding', line: 'AllowTcpForwarding no'}
      - {regexp: '^#?X11Forwarding', line: 'X11Forwarding no'}
    ssh_port: 2233
  tasks:
    - name: Ensure SSHD config file exists before proceeding
      ansible.builtin.stat:
        path: "{{ sshd_config_path }}"
      register: sshd_config_stat
      failed_when: not sshd_config_stat.stat.exists
    - name: Make the replacements
      ansible.builtin.lineinfile:
        path: "{{ sshd_config_path }}"
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
        state: present
        backup: true
        validate: 'sshd -t -f %s'
      loop: "{{ sshd_hardening_params }}"
      register: sshd_config_results
      notify: Restart SSHD Service

    - name: Check if any configuration changes occurred for wait_for task
      ansible.builtin.set_fact:
        config_changed: "{{ sshd_config_results.changed | bool }}"

    - name: Wait for SSH
      ansible.builtin.wait_for:
        port: "{{ ssh_port }}"
        host: "{{ ansible_host }}"
        timeout: 60
        delay: 5
        search_regex: ssh
      when: config_changed | bool

  handlers:
    - name: Restart SSHD Service
      ansible.builtin.systemd:
        name: sshd
        state: restarted
        daemon_reload: true
      listen: "Restart SSHD Service"