---
# vim: set expandtab tabstop=2 shiftwidth=2:

- name: sshd_config
  lineinfile:
    path: /etc/ssh/sshd_config
    insertafter: '^\s*#\s*{{item.key}}\s+'
    regexp: '^\s*{{item.key}}\s'
    line: '{{item.key}} {{item.value}}'
  with_dict:
    Port:                   '{{ssh_port|default(22)}}'
    PermitRootLogin:        'prohibit-password'
    StrictModes:            'yes'
    PubkeyAuthentication:   'yes'
    KerberosAuthentication: 'no'
    GSSAPIAuthentication:   'yes'
    TCPKeepAlive:           'yes'
    Ciphers:       'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
    MACs:          'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
    KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
- name: sshd_config
  lineinfile:
    path: /etc/ssh/sshd_config
    insertbefore: '\s*#?\s*HostKey\s+'
    regexp: '^# HostKeys for protocol'
    line: '# HostKeys for protocol'
- name: sshd_config - prefer ed25519
  lineinfile:
    path: /etc/ssh/sshd_config
    insertafter: '^# HostKeys for protocol'
    regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
    line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
- name: sshd_config - fallback rsa
  lineinfile:
    path: /etc/ssh/sshd_config
    insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
    regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
    line: 'HostKey /etc/ssh/ssh_host_rsa_key'
- name: 'sshd_config - absent dsa / ecdsa'
  lineinfile:
    path: /etc/ssh/sshd_config
    state: absent
    regexp: '{{item}}'
  with_list:
  - '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
  - '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'