From 6212ee42bd495424aebf1577096be1fef7de7f4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kacper=20=C5=BBbikowski?= <mail@kzbikowski.pl>
Date: Tue, 11 Aug 2026 23:31:54 +0200
Subject: [PATCH] Add inventory/security.yml

---
 inventory/security.yml | 43 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 inventory/security.yml

diff --git a/inventory/security.yml b/inventory/security.yml
new file mode 100644
index 0000000..40b1683
--- /dev/null
+++ b/inventory/security.yml
@@ -0,0 +1,43 @@
+---
+- name: Hardening SSH i Firewall
+  hosts: all
+  become: true
+  gather_facts: false
+
+  tasks:
+    - name: Sprawdzenie portu SSH
+      when: not (skip | default(false))
+      block:
+        - name: Wait for SSH
+          ansible.builtin.wait_for:
+            host: "{{ ansible_host | default(inventory_hostname) }}"
+            port: "{{ ansible_port | default(22) }}"
+            timeout: 3
+          delegate_to: localhost
+        - ansible.builtin.set_fact: host_is_online: true
+      rescue:
+        - ansible.builtin.set_fact: host_is_online: false
+
+    - name: Zabezpieczanie SSH
+      when:
+        - not (skip | default(false))
+        - host_is_online | default(false)
+      ignore_unreachable: true
+      block:
+        - name: Wyłączenie logowania hasłem w SSH
+          ansible.builtin.lineinfile:
+            path: /etc/ssh/sshd_config
+            regexp: '^#?PasswordAuthentication'
+            line: 'PasswordAuthentication no'
+
+        - name: Wyłączenie root login przez SSH
+          ansible.builtin.lineinfile:
+            path: /etc/ssh/sshd_config
+            regexp: '^#?PermitRootLogin'
+            line: 'PermitRootLogin prohibit-password'
+
+        - name: Restart usługi SSH (Debian/Ubuntu)
+          ansible.builtin.service:
+            name: ssh
+            state: restarted
+          when: ansible_os_family | default('') == 'Debian'
\ No newline at end of file