update from gigacoms

roles/openssh/.ansible-lint

@@ -1,71 +1,23 @@
 ---
-# Ansible-lint configuration
-# Uses production profile for highest quality standards
-
-# Profile selection (production is strictest)
 profile: production
 
-# Exclude paths
+# Paths to exclude from linting
 exclude_paths:
-  - .cache/
-  - .github/
   - collections/
-  - tests/output/
+  - .git/
-  - '*.md'
-  - .tox/
-  - molecule/default/molecule.yml
 
-# Enable specific security-focused rules
+# Treat these rule IDs as warnings instead of errors
-enable_list:
-  - no-log-password          # Require no_log for password fields
-  - risky-file-permissions   # Catch overly permissive file modes
-  - command-instead-of-shell # Prefer command over shell module
-  - name[casing]             # Enforce consistent task naming
-  - yaml[line-length]        # Max line length
-  - fqcn                     # Require Fully Qualified Collection Names
-  - jinja[spacing]           # Consistent Jinja2 formatting
-
-# Skip list for rules we explicitly don't need
-skip_list:
-  - role-name[path]          # We use namespace in paths (generic/lshw)
-  - galaxy[no-changelog]     # We don't use Galaxy
-
-# Strict mode - warnings become errors
-strict: true
-
-# Warn about potential issues
 warn_list:
-  - experimental             # Warn about experimental features
+  - experimental
-  - no-changed-when          # Tasks should have changed_when
+  - name
-  - no-handler               # Warn if notify without handler
+  - no-handler
+  - risky-shell-pipe
+  - no-changed-when
+  - risky-file-permissions
+  - yaml[trailing-spaces]
 
-# Task naming requirements
+# Skip rules that don't apply to this project
-task_name_prefix: "{stem} | "  # Optional prefix for better organization
+skip_list:
-
+  - var-naming[no-role-prefix]
-# Offline mode for CI/CD
+  - yaml[line-length]
-offline: false
+  - name[missing]
-
-# Mock modules that may not be available during linting
-mock_modules:
-  - docker_container
-  - docker_compose
-  - community.general.docker_compose
-
-# Mock roles for testing
-mock_roles:
-  - community.general
-  - ansible-role-openssh_server
-
-# Kinds of files to lint
-kinds:
-  - yaml: "**/*.yaml"
-  - yaml: "**/*.yml"
-  - playbook: "playbooks/*.yml"
-  - tasks: "roles/*/tasks/*.yml"
-  - handlers: "roles/*/handlers/*.yml"
-  - vars: "roles/*/vars/*.yml"
-  - vars: "roles/*/defaults/*.yml"
-  - meta: "roles/*/meta/*.yml"
-
-# Logging
-verbosity: 1

roles/openssh/.gitlab-ci.yml

@@ -0,0 +1,49 @@
+---
+# GitLab CI pipeline for Ansible infrastructure
+#
+# Required GitLab CI/CD Variables (Settings → CI/CD → Variables):
+#   ANSIBLE_SSH_USER        — SSH username for target servers
+#   ANSIBLE_SSHKEY_ID_RSA   — private SSH key (тип: File или Variable, содержимое id_rsa)
+#   ANSIBLE_BECOME_PASS     — sudo password
+#   VCENTER_USER            — vCenter username (e.g. administrator@vsphere.local)
+#   VCENTER_PASSWORD        — vCenter password
+#   ANSIBLE_GIT_TOKEN       — Project Access Token or Deploy Token with write_repository scope
+#                             (required for committing connection_history.json from the pages job)
+#                             Create: Settings → Access Tokens → role: Developer, scope: write_repository
+
+stages:
+  - validate
+
+# ── Shared configuration ───────────────────────────────────────────────────────
+default:
+  image: python:3.11-slim
+  before_script:
+    - apt-get update -qq
+    - apt-get install -y -qq --no-install-recommends openssh-client git
+    - pip install --quiet ansible ansible-lint pyvmomi requests netaddr
+    - ansible-galaxy collection install -r requirements.yml -p collections/ --force
+    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
+    - printf '%b\n' "$ANSIBLE_SSHKEY_ID_RSA" > ~/.ssh/id_rsa
+    - chmod 600 ~/.ssh/id_rsa
+    - eval $(ssh-agent -s)
+    - ssh-add ~/.ssh/id_rsa
+  interruptible: true
+
+variables:
+  ANSIBLE_FORCE_COLOR: "1"
+  ANSIBLE_HOST_KEY_CHECKING: "False"
+  ANSIBLE_ROLES_PATH: roles
+  ANSIBLE_COLLECTIONS_PATH: collections
+  ANSIBLE_FILTER_PLUGINS: filter_plugins
+  PIP_NO_CACHE_DIR: "1"
+  # inventory environment — change to 'staging' for a staging pipeline
+  INVENTORY: inventory/prod
+
+# ── Stage: validate ────────────────────────────────────────────────────────────
+lint:
+  stage: validate
+  script:
+    - ansible-lint .
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH

roles/openssh/README.md

@@ -1,13 +1,5 @@
 # Ansible Role: openssh_server
 
-[![CI](https://img.shields.io/badge/CI-ready-brightgreen)](https://github.com/welshwandering/ansible-role-openssh_server)
-[![Debian](https://img.shields.io/badge/Debian-11%20to%2014-A81D33?style=for-the-badge&logo=debian&logoColor=white)](docs/DISTRIBUTIONS.md)
-[![Ubuntu](https://img.shields.io/badge/Ubuntu-22.04%20to%2025.10-E95420?style=for-the-badge&logo=ubuntu&logoColor=white)](docs/DISTRIBUTIONS.md)
-[![Rocky Linux](https://img.shields.io/badge/Rocky_Linux-8%20to%2010-10B981?style=for-the-badge&logo=rocky-linux&logoColor=white)](docs/DISTRIBUTIONS.md)
-[![Fedora](https://img.shields.io/badge/Fedora-43-51A2DA?style=for-the-badge&logo=fedora&logoColor=white)](docs/DISTRIBUTIONS.md)
-![Ansible](https://img.shields.io/badge/Ansible-EE0000?style=for-the-badge&logo=ansible&logoColor=white)
-[![License](https://img.shields.io/badge/License-MIT-blue?style=for-the-badge)](LICENSE)
-
 Comprehensive OpenSSH server hardening for Debian and Ubuntu systems with support for 16 compliance frameworks, extensive CVE tracking, and version-aware capability detection.
 
 ## ✨ Features
@@ -27,15 +19,6 @@ Comprehensive OpenSSH server hardening for Debian and Ubuntu systems with suppor
 
 ### Installation
 
-Add to your `requirements.yml`:
-
-```yaml
-roles:
-  - src: https://github.com/welshwandering/ansible-role-openssh_server
-    name: openssh_server
-    scm: git
-```
-
 Then install:
 
 ```bash

roles/openssh/meta/main.yml

@@ -41,9 +41,7 @@ galaxy_info:
         - "10"
     - name: Rocky
       versions:
-        - "8"
+        - "all"
-        - "9"
-        - "10"
     - name: Fedora
       versions:
         - "43"

roles/openssh/requirements.yml

@@ -0,0 +1,10 @@
+---
+collections:
+  - name: ansible.posix
+    version: ">=1.5.0"
+  - name: ansible.utils
+    version: ">=2.0.0,<5.0.0"
+  - name: community.general
+    version: ">=8.0.0"
+  - name: community.vmware
+    version: ">=4.0.0"

roles/openssh/tasks/main.yml

@@ -113,21 +113,21 @@
 - name: Set OpenSSH capability flags
   ansible.builtin.set_fact:
     # Core capabilities for backwards compatibility
-    openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
+    openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
-    openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
+    openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
-    openssh_has_fido2: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
+    openssh_has_fido2: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
-    openssh_has_include: "{{ openssh_version is defined and openssh_version >= 8.2 }}"
+    openssh_has_include: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}"
-    openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version >= 8.5 }}"
+    openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version is version('8.5', '>=') }}"
-    openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version >= 9.3 }}"
+    openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version is version('9.3', '>=') }}"
-    openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version >= 9.8 }}"
+    openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version is version('9.8', '>=') }}"
-    openssh_has_mlkem: "{{ openssh_version is defined and openssh_version >= 9.9 }}"
+    openssh_has_mlkem: "{{ openssh_version is defined and openssh_version is version('9.9', '>=') }}"
     # Algorithm support flags
-    openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version >= 7.2 }}"
+    openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version is version('7.2', '>=') }}"
-    openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version >= 7.4 }}"
+    openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}"
     # Security restriction flags
-    openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version >= 7.9 }}"
+    openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}"
-    openssh_removes_dsa: "{{ openssh_version is defined and openssh_version >= 9.6 }}"
+    openssh_removes_dsa: "{{ openssh_version is defined and openssh_version is version('9.6', '>=') }}"
-    openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version >= 10.0 }}"
+    openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version is version('10.0', '>=') }}"
   tags:
     - openssh
     - facts
@@ -139,7 +139,7 @@
     openssh_ca_signature_algorithms: "{{ openssh_ca_signature_algorithms | reject('match', '^sk-') | list }}"
   when:
     - openssh_version is defined
-    - openssh_version < 8.2
+    - openssh_version is version('8.2', '<')
   tags:
     - openssh
     - facts

roles/openssh/templates/sshd_config.j2

@@ -9,7 +9,7 @@ ListenAddress {{ address }}
 {% endfor %}
 
 # Protocol (deprecated directive in newer OpenSSH, kept for compatibility)
-{% if openssh_version is defined and openssh_version < 7.4 %}
+{% if openssh_version is defined and openssh_version is version('7.4', '<') %}
 Protocol {{ openssh_protocol }}
 {% endif %}
 
@@ -153,6 +153,6 @@ GatewayPorts no
 {% if openssh_has_persourcepenalties | default(false) and openssh_enable_persourcepenalties %}
 # Automatic penalties for repeated failures and suspicious behavior
 PerSourcePenalties authfail:{{ openssh_persource_authfail_penalty }} noauth:{{ openssh_persource_noauth_penalty }} crash:{{ openssh_persource_crash_penalty }}
-PerSourceMaxStartups {{ openssh_persource_maxstartups }}
+PerSourceMaxStartups '{{ openssh_persource_maxstartups }}'
 PerSourceNetBlockSize {{ openssh_persource_netblock_ipv4 }}:{{ openssh_persource_netblock_ipv6 }}
 {% endif %}