ansible rework

ansible/roles/ssh_hardening/defaults/main.yaml

@@ -2,9 +2,10 @@
 # SSH Hardening Role Default Variables
 
 # Networks allowed to access SSH (VPC and WireGuard)
+# These reference the centralized network variables from group_vars/network.yaml
 ssh_allowed_networks:
-  - 10.20.0.0/24  # WireGuard VPN
-  - 10.10.0.0/20  # Internal VPC
+  - "{{ wireguard_network }}"  # WireGuard VPN
+  - "{{ vpc_network }}"  # Internal VPC
 
 # Whether to allow public SSH access for git operations (Forgejo)
 # Set to true on Forgejo host, false on other servers

ansible/roles/ssh_hardening/tasks/main.yaml

@@ -16,7 +16,30 @@
     owner: root
     group: root
     validate: 'sshd -t -f %s'
-  notify: restart sshd
+  register: ssh_config_changed
+
+- name: Restart SSH daemon asynchronously (to maintain connection)
+  ansible.builtin.shell: "nohup systemctl restart sshd &"
+  when: ssh_config_changed.changed
+  changed_when: true
+
+- name: Wait for SSH port to become available
+  ansible.builtin.wait_for:
+    host: "{{ ansible_host | default(inventory_hostname) }}"
+    port: 22
+    delay: 2
+    timeout: 30
+    state: started
+  when: ssh_config_changed.changed
+  delegate_to: localhost
+
+- name: Reset SSH connection to pick up new configuration
+  ansible.builtin.meta: reset_connection
+  when: ssh_config_changed.changed
+
+- name: Verify SSH connection after restart
+  ansible.builtin.ping:
+  when: ssh_config_changed.changed
 
 - name: Configure iptables for SSH restrictions (non-Forgejo servers)
   block:
@@ -25,7 +48,7 @@
         chain: INPUT
         protocol: tcp
         destination_port: '22'
-        source: 10.20.0.0/24
+        source: "{{ wireguard_network }}"
         jump: ACCEPT
         comment: Allow SSH from WireGuard VPN
 
@@ -34,7 +57,7 @@
         chain: INPUT
         protocol: tcp
         destination_port: '22'
-        source: 10.10.0.0/20
+        source: "{{ vpc_network }}"
         jump: ACCEPT
         comment: Allow SSH from internal VPC
 

ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2

@@ -20,13 +20,10 @@ KexAlgorithms {{ ssh_kex_algorithms | join(',') }}
 PubkeyAcceptedAlgorithms {{ ssh_pubkey_accepted_algorithms | join(',') }}
 
 # Access control - restrict shell users to trusted networks only
-{% for user in ssh_shell_users %}
-{% for network in ssh_allowed_networks %}
-AllowUsers {{ user }}@{{ network }}
-{% endfor %}
-{% endfor %}
+{% if ssh_shell_users | length > 0 and ssh_allowed_networks | length > 0 %}
+AllowUsers {% for user in ssh_shell_users %}{% for network in ssh_allowed_networks %}{{ user }}@{{ network }} {% endfor %}{% endfor %}{% if ssh_allow_public_git %}{{ ssh_git_user }}{% endif %}
 
-{% if ssh_allow_public_git %}
+{% elif ssh_allow_public_git %}
 # Allow Forgejo git user from anywhere for git operations
 AllowUsers {{ ssh_git_user }}
 {% endif %}