---
- name: Playbook to make sshd changes
  hosts: all
  gather_facts: true
  vars:
    sshd_config_path: /etc/ssh/sshd_config
    sshd_configd: /etc/ssh/sshd_config.d/50-redhat.conf
    sshd_hardening_params:
      - {regexp: '^#?AllowAgentForwarding', line: 'AllowAgentForwarding no'}
      - {regexp: '^#?AllowTcpForwarding', line: 'AllowTcpForwarding no'}
      - {regexp: '^#?X11Forwarding', line: 'X11Forwarding no'}
    ssh_port: 2233

  tasks:
    - name: Ensure SSHD config file exists before proceeding
      ansible.builtin.stat:
        path: "{{ sshd_config_path }}"
      register: sshd_config_stat
      failed_when: not sshd_config_stat.stat.exists

    - name: Make the replacements
      ansible.builtin.lineinfile:
        path: "{{ sshd_config_path }}"
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
        state: present
        backup: true
        validate: 'sshd -t -f %s'
      loop: "{{ sshd_hardening_params }}"

    - name: Alma9 has one more do replace
      ansible.builtin.lineinfile:
        path: "{{ sshd_configd }}"
        regexp: '^#?X11Forwarding'
        line: 'X11Forwarding no'
        state: present
        backup: true
        validate: 'sshd -t -f %s'

    - name: Restart sshd daemon
      ansible.builtin.systemd:
        name: sshd.service
        state: restarted

    - name: Verify if the options are there
      ansible.builtin.shell: |
        set -o pipefail
        sshd -T -C lport=2233| egrep "x11forwarding|allowtcpforwarding|allowagentforwarding"
      args:
        executable: /bin/bash
      register: ssh_out
      changed_when: "'yes' in ssh_out.stdout"
      tags:
        - check

    - name: Check sshd status
      ansible.builtin.systemd:
        name: sshd.service
      register: sshd_config_status

    - name: Check sshd status
      ansible.builtin.debug:
        msg: "SSH is not runing as expected"
      when: sshd_config_status.status.ActiveState != "active"