---
- name: Playbook to make sshd changes
  hosts: all
  gather_facts: false
  vars:
    sshd_config_path: /etc/ssh/sshd_config
    sshd_hardening_params:
      - {regexp: '^#?AllowAgentForwarding', line: 'AllowAgentForwarding no'}
      - {regexp: '^#?AllowTcpForwarding', line: 'AllowTcpForwarding no'}
      - {regexp: '^#?X11Forwarding', line: 'X11Forwarding no'}
    ssh_port: 2233

  tasks:
    - name: Ensure SSHD config file exists before proceeding
      ansible.builtin.stat:
        path: "{{ sshd_config_path }}"
      register: sshd_config_stat
      failed_when: not sshd_config_stat.stat.exists

    - name: Make the replacements
      ansible.builtin.lineinfile:
        path: "{{ sshd_config_path }}"
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
        state: present
        backup: true
        validate: 'sshd -t -f %s'
      loop: "{{ sshd_hardening_params }}"
      register: sshd_config_results
      notify: Restart SSHD Service

    - name: Check sshd status
      ansible.builtin.debug:
        msg: "SSH is not runing as expected"
      when: sshd_config..status.ActiveState != "active"

  handlers:
    - name: Restart SSHD Service
      ansible.builtin.systemd:
        name: sshd
        state: restarted
        daemon_reload: true
      listen: "Restart SSHD Service"