yay! so this actually works

playbooks/setup/server/natsuco.yaml

@@ -3,17 +3,16 @@
     - tmp.kevinnlsamuel.com
   vars:
     ansible_user: root
+    alt_ssh_port: 1023
   name: setup server natsuco
   tasks:
     - name: harden ssh
       block:
         - name: disable password auth
-          file:
+          copy:
             src: sshd/00-nopasswd.conf
             dest: /etc/ssh/ssh_config.d/00-altport.conf
         - name: change ssh port
-          vars:
-            port: 1023
           template:
             src: sshd/00-altport.conf
             dest: /etc/ssh/ssh_config.d/00-altport.conf
@@ -21,4 +20,5 @@
       dnf:
         state: present
         name: policycoreutils-python-utils
-    - command: /usr/sbin/semanage port -a -t ssh_port_t -p tcp 1023
+    - name: give sshd access to alt port on selinux
+      command: "/usr/sbin/semanage port -a -t ssh_port_t -p tcp {{ alt_ssh_port }}"

playbooks/setup/server/templates/sshd/00-altport.conf

@@ -1 +1 @@
-Port {{ port }}
+Port {{ alt_ssh_port }}