From 37aeddca6ca3544a53b3dfaa86be019af8ac4981 Mon Sep 17 00:00:00 2001
From: Maxim Vershinin <im@vmn.su>
Date: Sun, 12 Jul 2026 15:54:39 +0000
Subject: [PATCH] REFACTOR: handlers moved from LXC setting up playbook to
 harden ssh task

---
 playbooks/deploy.yaml                         | 13 +------------
 roles/basic_postinstall/tasks/harden_ssh.yaml | 16 ++++++++++++++--
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index cd5802c..b492713 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -14,15 +14,4 @@
     ../inventory/group_vars/all/secrets.yaml
   vars:
     ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
-    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
-
-  handlers:
-    - name: restart ssh-server
-      service:
-        name: ssh
-        state: restarted
-    
-    - name: restart sshd-server
-      service:
-        name: sshd
-        state: restarted
\ No newline at end of file
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
\ No newline at end of file
diff --git a/roles/basic_postinstall/tasks/harden_ssh.yaml b/roles/basic_postinstall/tasks/harden_ssh.yaml
index 2f0a845..a1486dd 100644
--- a/roles/basic_postinstall/tasks/harden_ssh.yaml
+++ b/roles/basic_postinstall/tasks/harden_ssh.yaml
@@ -5,7 +5,6 @@
     src: "{{ role_path }}/files/hardened_sshd.conf"
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
-  notify: restart ssh-server
   when: ansible_facts['distribution'] == 'Ubuntu'
 
 - name: Configure ssh-server daemon
@@ -13,7 +12,6 @@
     src: "{{ role_path }}/files/hardened_sshd.conf"
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
-  notify: restart sshd-server
   when: ansible_facts['distribution'] == 'Debian'
 
 - name: Configure ssh client
@@ -22,3 +20,17 @@
     src: "{{ role_path }}/files/hardened_ssh.conf"
     dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
     mode: u=rw,g=r,o=r
+
+- name: Restart ssh-server Debian
+  remote_user: ansible
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
+  when: ansible_facts['distribution'] == 'Debian'
+
+- name: Restart ssh-server Ubuntu
+  remote_user: ansible
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+  when: ansible_facts['distribution'] == 'Ubuntu'