feat: replace SSH hardening step with devsec.hardening role

galaxy.yml

@@ -9,3 +9,6 @@ authors:
 description: Studio Ansible collection containing common roles
 license:
   - MIT
+
+dependencies:
+  "devsec.hardening": ">=9.0.0"

roles/security/tasks/main.yml

@@ -1,22 +1,10 @@
 ---
-- name: Create SSH drop-in directory
+- name: Harden SSH configuration
-  ansible.builtin.file:
+  ansible.builtin.import_role:
-    path: /etc/ssh/sshd_config.d
+    name: devsec.hardening.ssh_hardening
-    state: directory
+  vars:
-    owner: root
+    ssh_permit_root_login: "no"
-    group: root
+    ssh_password_authentication: "no"
-    mode: "0755"
-  become: true
-
-- name: Harden SSH configuration with drop-in template
-  ansible.builtin.template:
-    src: sshd.conf.j2
-    dest: /etc/ssh/sshd_config.d/sshd.conf
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Restart sshd
-  become: true
 
 - name: Install fail2ban
   ansible.builtin.apt:

roles/security/templates/sshd.conf.j2

@@ -1,5 +0,0 @@
-## Disable root login
-PermitRootLogin no
-
-## Disable password authentication
-PasswordAuthentication no