rearrange a lot

playbooks/setup/server/natsuco.yaml

@@ -3,22 +3,10 @@
     - tmp.kevinnlsamuel.com
   vars:
     ansible_user: root
+    alt_ssh_port: 1023
   name: setup server natsuco
+
+  roles:
+    - kevinnlsamuel.galaxy.sshd.disablepasswd
+    - kevinnlsamuel.galaxy.sshd.altport
   tasks:
-    - name: harden ssh
-      block:
-        - name: disable password auth
-          file:
-            src: sshd/00-nopasswd.conf
-            dest: /etc/ssh/ssh_config.d/00-altport.conf
-        - name: change ssh port
-          vars:
-            port: 1023
-          template:
-            src: sshd/00-altport.conf
-            dest: /etc/ssh/ssh_config.d/00-altport.conf
-    - name: install semanage
-      dnf:
-        state: present
-        name: policycoreutils-python-utils
-    - command: /usr/sbin/semanage port -a -t ssh_port_t -p tcp 1023

playbooks/setup/server/templates/sshd/00-altport.conf

@@ -1 +1 @@
-Port {{ port }}
+Port {{ alt_ssh_port }}

roles/sshd/_handlers/main.yaml

@@ -0,0 +1,5 @@
+---
+- name: restart sshd
+  service:
+    name: sshd
+    state: restarted

roles/sshd/altport/handlers

@@ -0,0 +1 @@
+/home/kevins/Projects/galaxy/roles/sshd/_handlers

roles/sshd/altport/tasks/main.yaml

@@ -0,0 +1,16 @@
+---
+- name: change ssh port to {{ alt_ssh_port | mandatory }}
+  notify: restart sshd
+  template:
+    src: 00-altport.conf
+    dest: /etc/ssh/sshd_config.d/00-altport.conf
+- name: install semanage
+  when: ansible_facts.selinux.status != 'disabled'
+  dnf:
+    state: present
+    name: policycoreutils-python-utils
+- name: give sshd access to alt port on selinux
+  register: result_change_to_alt_port
+  ignore_errors: true
+  changed_when: "'already defined' not in result_change_to_alt_port.stdout"
+  command: semanage port -a -t ssh_port_t -p tcp {{ alt_ssh_port }}

roles/sshd/altport/templates/00-altport.conf

@@ -0,0 +1 @@
+Port {{ alt_ssh_port }}

roles/sshd/disablepasswd/handlers

@@ -0,0 +1 @@
+/home/kevins/Projects/galaxy/roles/sshd/_handlers

roles/sshd/disablepasswd/tasks/main.yml

@@ -0,0 +1,5 @@
+- name: disable password auth
+  notify: restart sshd
+  copy:
+    src: 00-nopasswd.conf
+    dest: /etc/ssh/sshd_config.d/00-nopasswd.conf