pi-ansible/roles/os_config/tasks/ssh.yml

# vim: ft=yaml.ansible
---
- name: Add public SSH key to default user
  ansible.posix.authorized_key:
    user: "{{ ansible_user }}"
    key: "{{ ssh_keys | join('\n') }}"
    exclusive: true

- name: Allow SSH login with public keys
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PubkeyAuthentication '
    line: PubkeyAuthentication yes
    state: present
  notify: sshd

- name: Disallow SSH login with password
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PasswordAuthentication '
    line: PasswordAuthentication no
    state: present
  notify: sshd

- name: Disallow root login over SSH
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PermitRootLogin '
    line: PermitRootLogin no
    state: present
  notify: sshd