sshd_config: checks for include-option, provided => write to 99-default.conf, else to sshd_config and prepend include to sshd_config, if not found.

tasks/sshd_config.yml

@@ -1,15 +1,35 @@
 ---
 # vim: set expandtab tabstop=2 shiftwidth=2:
 
-- when: '"debian" == ansible_facts["distribution"]|lower and 12 <= ansible_facts["distribution_version"]|int'
+- name: 'check sshd include option'
-  name: 'sshd_config.d/99-default.conf'
+  command: 'sshd -o "include /dev/null"'
-  template:
+  register: sshd_include_option_check
-    src:  'sshd-default.conf.j2'
+  failed_when: 'sshd_include_option_check.rc not in [1,255] or sshd_include_option_check.stderr not in ["Include directive not supported as a command-line option", "command-line: line 0: Bad configuration option: include"]'
-    dest: '/etc/ssh/sshd_config.d/99-default.conf'
+- set_facts:
-    owner:  root
+    sshd_include_option: 'sshd_include_option_check.stderr == "Include directive not supported as a command-line option"'
-    group:  root
+- when: 'true == sshd_include_option'
-    mode:   0644
+  block:
-- when: '"debian" != ansible_facts["distribution"]|lower or  11 >= ansible_facts["distribution_version"]|int'
+  - name: '/etc/ssh/sshd_config.d'
+    file:
+      type: directory
+      dest: '/etc/ssh/sshd_config.d'
+      owner: root
+      group: root
+      mode: 0644
+  - name: 'sshd_config.d/99-default.conf'
+    template:
+      src:  'sshd-default.conf.j2'
+      dest: '/etc/ssh/sshd_config.d/99-default.conf'
+      owner:  root
+      group:  root
+      mode:   0644
+  - lineinfile:
+      path:         /etc/ssh/sshd_config
+      insertbefore: BOF
+      regexp:       '^\s*include\s+/etc/ssh/sshd_config.d/'
+      line:         'include /etc/ssh/sshd_config.d/*.conf'
+      firstmatch:   true
+- when: 'false == sshd_include_option'
   block:
   - name: sshd_config
     lineinfile: