From e5cf177ee8ae48317dd31319d261376636aa7ff0 Mon Sep 17 00:00:00 2001
From: Ludovic Cartier <ludovic.cartier@alterway.fr>
Date: Thu, 18 Jun 2026 17:17:37 +0200
Subject: [PATCH] ssh - add ansible login restrictions

---
 tasks/ssh.yml                  | 9 +++++++++
 templates/sshd_ansible_conf.j2 | 6 ++++++
 2 files changed, 15 insertions(+)
 create mode 100644 templates/sshd_ansible_conf.j2

diff --git a/tasks/ssh.yml b/tasks/ssh.yml
index 93ea009..acba97f 100644
--- a/tasks/ssh.yml
+++ b/tasks/ssh.yml
@@ -1,3 +1,12 @@
+- name: SSH | configure ansible login restrictions
+  template:
+    src: sshd_ansible_conf.j2
+    dest: /etc/ssh/sshd_config.d/ansible.conf
+    mode: '0644'
+    validate: /usr/sbin/sshd -t -f %s
+  when: ssh_ansible_authorized_ips is defined
+  register: sshd_conf_changes
+
 - name: SSH | configure root login restrictions
   template:
     src: sshd_root_conf.j2
diff --git a/templates/sshd_ansible_conf.j2 b/templates/sshd_ansible_conf.j2
new file mode 100644
index 0000000..afc81ce
--- /dev/null
+++ b/templates/sshd_ansible_conf.j2
@@ -0,0 +1,6 @@
+{% if ssh_ansible_authorized_ips is defined %}
+{% for ip in ssh_ansible_authorized_ips %}
+Match Address {{ ip }}
+  AllowUsers ansible
+{% endfor %}
+{% endif %}