From d98c0b7f6577aaee7d8552cdf9ebc7857715fd28 Mon Sep 17 00:00:00 2001
From: alessandrovitali <mail@alessandrovitali.net>
Date: Fri, 4 Sep 2026 00:42:31 +0200
Subject: [PATCH] validate SSH drop-in template

---
 roles/security/tasks/main.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/roles/security/tasks/main.yml b/roles/security/tasks/main.yml
index 5d4c252..ae52a87 100644
--- a/roles/security/tasks/main.yml
+++ b/roles/security/tasks/main.yml
@@ -17,6 +17,7 @@
         owner: root
         group: root
         mode: "0644"
+        validate: /usr/sbin/sshd -t -f %s
       notify: Restart sshd
 
 - name: Enable fail2ban
@@ -32,4 +33,4 @@
       ansible.builtin.service:
         name: fail2ban
         state: started
-        enabled: yes
+        enabled: true