that was so silly + restart sshd after disablepasswd

playbooks/setup/server/natsuco.yaml

@@ -3,17 +3,16 @@
     - tmp.kevinnlsamuel.com
   vars:
     ansible_user: root
+    alt_ssh_port: 1023
   name: setup server natsuco
   tasks:
     - name: harden ssh
       block:
         - name: disable password auth
-          file:
+          include_role:
-            src: sshd/00-nopasswd.conf
+            name: kevinnlsamuel.galaxy.sshd.disablepasswd
-            dest: /etc/ssh/ssh_config.d/00-altport.conf
         - name: change ssh port
-          vars:
+          when: false
-            port: 1023
           template:
             src: sshd/00-altport.conf
             dest: /etc/ssh/ssh_config.d/00-altport.conf
@@ -21,4 +20,8 @@
       dnf:
         state: present
         name: policycoreutils-python-utils
-    - command: /usr/sbin/semanage port -a -t ssh_port_t -p tcp 1023
+    - name: give sshd access to alt port on selinux
+      register: result_change_to_alt_port
+      ignore_errors: true
+      changed_when: "'already defined' not in result_change_to_alt_port.stdout"
+      command: semanage port -a -t ssh_port_t -p tcp {{ alt_ssh_port }}

playbooks/setup/server/templates/sshd/00-altport.conf

@@ -1 +1 @@
-Port {{ port }}
+Port {{ alt_ssh_port }}

roles/sshd/disablepasswd/meta/main.yml

@@ -0,0 +1,6 @@
+galaxy_info:
+  author: kevinnlsamuel
+  description: sayin hello
+dependencies:
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/sshd/disablepasswd/tasks/main.yml

@@ -0,0 +1,8 @@
+- name: disable password auth
+  copy:
+    src: 00-nopasswd.conf
+    dest: /etc/ssh/sshd_config.d/00-nopasswd.conf
+- name: restart sshd
+  service:
+    name: sshd
+    state: restarted