---
- hosts:
    - tmp.kevinnlsamuel.com
  vars:
    ansible_user: root
    alt_ssh_port: 1023
  name: setup server natsuco
  tasks:
    - name: harden ssh
      block:
        - name: disable password auth
          include_role:
            name: kevinnlsamuel.galaxy.sshd.disablepasswd
        - name: change ssh port
          template:
            src: sshd/00-altport.conf
            dest: /etc/ssh/ssh_config.d/00-altport.conf
    - name: install semanage
      dnf:
        state: present
        name: policycoreutils-python-utils
    - name: give sshd access to alt port on selinux
      command: "/usr/sbin/semanage port -a -t ssh_port_t -p tcp {{ alt_ssh_port }}"