REFACTOR: handlers moved from LXC setting up playbook to harden ssh task

playbooks/deploy.yaml

@@ -14,15 +14,4 @@
     ../inventory/group_vars/all/secrets.yaml
   vars:
     ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
-    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
-
-  handlers:
-    - name: restart ssh-server
-      service:
-        name: ssh
-        state: restarted
-    
-    - name: restart sshd-server
-      service:
-        name: sshd
-        state: restarted
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"

roles/basic_postinstall/tasks/harden_ssh.yaml

@@ -5,7 +5,6 @@
     src: "{{ role_path }}/files/hardened_sshd.conf"
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
-  notify: restart ssh-server
   when: ansible_facts['distribution'] == 'Ubuntu'
 
 - name: Configure ssh-server daemon
@@ -13,7 +12,6 @@
     src: "{{ role_path }}/files/hardened_sshd.conf"
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
-  notify: restart sshd-server
   when: ansible_facts['distribution'] == 'Debian'
 
 - name: Configure ssh client
@@ -22,3 +20,17 @@
     src: "{{ role_path }}/files/hardened_ssh.conf"
     dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
     mode: u=rw,g=r,o=r
+
+- name: Restart ssh-server Debian
+  remote_user: ansible
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
+  when: ansible_facts['distribution'] == 'Debian'
+
+- name: Restart ssh-server Ubuntu
+  remote_user: ansible
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+  when: ansible_facts['distribution'] == 'Ubuntu'