---
# Restricts SSH to the WireGuard and VPC networks (plus the public git
# user on asxpio-ops). Run by hand over WireGuard: a mistake here locks
# everyone out, so it is deliberately not part of site.yaml.
#
#   ansible-playbook playbooks/02-ssh-hardening.yaml --check --diff

- name: Harden SSH configuration
  hosts: asxpio
  become: true
  gather_facts: true
  vars:
    ansible_host: "{{ wireguard_ip }}"
  roles:
    - role: ssh_hardening