2 files changed, 49 insertions, 0 deletions
diff --git a/roles/sshd/templates/generate_dns.j2 b/roles/sshd/templates/generate_dns.j2
new file mode 100644
index 0000000..5d58ae9
--- /dev/null
+++ b/roles/sshd/templates/generate_dns.j2
@@ -0,0 +1,24 @@
+
+# ssh configuration for dns ~~ ~/.ssh/.config.d/
+# managed by Ansible
+
+{% for h in groups["all"] %}
+{% set h = hostvars[h] %}
+{##}
+{% if h.ip is defined and h.services is defined %}
+{% set _port = h.services | selectattr("name", "equalto", "ssh") | map(attribute="port") | list | join(' ') %}
+{##}
+# {{ h.ansible_host }}
+
+Match originalhost {{ h.ansible_host }} exec "ls /sys/class/net/{{ _i.dcontroller }} && ! ping -c 1 -W 5 {{ h.ip.out }}"
+	HostName {{ h.ip.in }}
+	Port {{ _port }}
+
+Match originalhost {{ h.ansible_host }}
+	HostName {{ h.ip.out  }}
+	Port {{ _port }}
+	User root
+
+{% endif %}
+{##}
+{% endfor %}
diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2
new file mode 100644
index 0000000..a11268e
--- /dev/null
+++ b/roles/sshd/templates/sshd_config.j2
@@ -0,0 +1,25 @@
+
+# ssh ~~ /etc/ssh/sshd_config
+# managed by Ansible
+
+# security
+PermitRootLogin yes
+MaxAuthTries 6
+MaxSessions 10
+
+# auth
+AuthorizedKeysFile .ssh/authorized_keys
+PasswordAuthentication no
+PermitEmptyPasswords no
+ClientAliveInterval 180
+
+
+{% if ansible_facts["os_family"] == "OpenBSD" or ansible_facts["os_family"] == "Alpine" %}
+Subsystem sftp /usr/libexec/sftp-server
+{% elif ansible_facts["os_family"] == "Debian" %}
+ChallengeResponseAuthentication no
+UsePAM yes
+PrintMotd no
+UsePrivilegeSeparation sandbox
+Subsystem sftp /usr/lib/ssh/sftp-server
+{% endif %}