From 8e0a292b1dfbb6c374388781379d6931f066d3bf Mon Sep 17 00:00:00 2001
From: Alan Orth <alan.orth@gmail.com>
Date: Sun, 23 Aug 2015 00:00:43 +0300
Subject: [PATCH] roles/common: Move sshd tasks to their own playbook

Signed-off-by: Alan Orth <alan.orth@gmail.com>
---
 roles/common/tasks/main.yml | 16 +---------------
 roles/common/tasks/sshd.yml | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 15 deletions(-)
 create mode 100644 roles/common/tasks/sshd.yml

diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index 5e93f0d..aaa9f19 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -16,21 +16,7 @@
   when: ansible_os_family == 'Debian'
   tags: firewall
 
-- name: Reconfigure /etc/ssh/sshd_config
-  template: src=sshd_config_{{ansible_distribution}}-{{ansible_distribution_version}}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
-  notify:
-    - restart sshd
-  tags: sshd
-
-- name: Remove DSA and ECDSA host keys
-  file: name=/etc/ssh/{{ item }} state=absent
-  with_items:
-    - ssh_host_dsa_key
-    - ssh_host_dsa_key.pub
-    - ssh_host_ecdsa_key
-    - ssh_host_ecdsa_key.pub
-  notify:
-    - restart sshd
+- include: sshd.yml
   tags: sshd
 
 - name: Reconfigure /etc/sysctl.conf
diff --git a/roles/common/tasks/sshd.yml b/roles/common/tasks/sshd.yml
new file mode 100644
index 0000000..e1773ff
--- /dev/null
+++ b/roles/common/tasks/sshd.yml
@@ -0,0 +1,25 @@
+---
+
+# SSH configs don't change in Debian / CentOS minor versions
+- name: Reconfigure /etc/ssh/sshd_config
+  template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
+  when: (ansible_distribution == 'Debian' or ansible_distribution == 'CentOS')
+  notify: reload sshd
+
+# Ubuntu is the only distro we have where SSH version is very different from 14.04 -> 14.10,
+# ie with new ciphers supported etc.
+- name: Reconfigure /etc/ssh/sshd_config
+  template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600
+  when: ansible_distribution == 'Ubuntu'
+  notify: reload sshd
+
+- name: Remove DSA and ECDSA host keys
+  file: name=/etc/ssh/{{ item }} state=absent
+  with_items:
+    - ssh_host_dsa_key
+    - ssh_host_dsa_key.pub
+    - ssh_host_ecdsa_key
+    - ssh_host_ecdsa_key.pub
+  notify: reload sshd
+
+# vim: set sw=2 ts=2: