ansible rework

ansible/roles/ssh_hardening/tasks/main.yaml

@@ -16,7 +16,30 @@
     owner: root
     group: root
     validate: 'sshd -t -f %s'
-  notify: restart sshd
+  register: ssh_config_changed
+
+- name: Restart SSH daemon asynchronously (to maintain connection)
+  ansible.builtin.shell: "nohup systemctl restart sshd &"
+  when: ssh_config_changed.changed
+  changed_when: true
+
+- name: Wait for SSH port to become available
+  ansible.builtin.wait_for:
+    host: "{{ ansible_host | default(inventory_hostname) }}"
+    port: 22
+    delay: 2
+    timeout: 30
+    state: started
+  when: ssh_config_changed.changed
+  delegate_to: localhost
+
+- name: Reset SSH connection to pick up new configuration
+  ansible.builtin.meta: reset_connection
+  when: ssh_config_changed.changed
+
+- name: Verify SSH connection after restart
+  ansible.builtin.ping:
+  when: ssh_config_changed.changed
 
 - name: Configure iptables for SSH restrictions (non-Forgejo servers)
   block:
@@ -25,7 +48,7 @@
         chain: INPUT
         protocol: tcp
         destination_port: '22'
-        source: 10.20.0.0/24
+        source: "{{ wireguard_network }}"
         jump: ACCEPT
         comment: Allow SSH from WireGuard VPN
 
@@ -34,7 +57,7 @@
         chain: INPUT
         protocol: tcp
         destination_port: '22'
-        source: 10.10.0.0/20
+        source: "{{ vpc_network }}"
         jump: ACCEPT
         comment: Allow SSH from internal VPC