Add inventory/security.yml

inventory/security.yml

@@ -0,0 +1,43 @@
+---
+- name: Hardening SSH i Firewall
+  hosts: all
+  become: true
+  gather_facts: false
+
+  tasks:
+    - name: Sprawdzenie portu SSH
+      when: not (skip | default(false))
+      block:
+        - name: Wait for SSH
+          ansible.builtin.wait_for:
+            host: "{{ ansible_host | default(inventory_hostname) }}"
+            port: "{{ ansible_port | default(22) }}"
+            timeout: 3
+          delegate_to: localhost
+        - ansible.builtin.set_fact: host_is_online: true
+      rescue:
+        - ansible.builtin.set_fact: host_is_online: false
+
+    - name: Zabezpieczanie SSH
+      when:
+        - not (skip | default(false))
+        - host_is_online | default(false)
+      ignore_unreachable: true
+      block:
+        - name: Wyłączenie logowania hasłem w SSH
+          ansible.builtin.lineinfile:
+            path: /etc/ssh/sshd_config
+            regexp: '^#?PasswordAuthentication'
+            line: 'PasswordAuthentication no'
+
+        - name: Wyłączenie root login przez SSH
+          ansible.builtin.lineinfile:
+            path: /etc/ssh/sshd_config
+            regexp: '^#?PermitRootLogin'
+            line: 'PermitRootLogin prohibit-password'
+
+        - name: Restart usługi SSH (Debian/Ubuntu)
+          ansible.builtin.service:
+            name: ssh
+            state: restarted
+          when: ansible_os_family | default('') == 'Debian'