From 6390e6288b1fc6ad203856b53a2146dc3bbcd7a2 Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Fri, 9 Oct 2026 14:37:24 +0000
Subject: [PATCH] Disable SSH password auth in the common role only when sshd
 is active

---
 common/tasks/ssh.yml | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/common/tasks/ssh.yml b/common/tasks/ssh.yml
index a3671d2..17a61a8 100644
--- a/common/tasks/ssh.yml
+++ b/common/tasks/ssh.yml
@@ -1,12 +1,20 @@
-- name: Disable SSH password auth
-  lineinfile:
-      dest: /etc/ssh/sshd_config
-      regexp: '^PasswordAuthentication\s*yes'
-      line: "PasswordAuthentication no"
-  register: sshd_config
+- name: Check if SSH daemon is active
+  systemd:
+    name: sshd
+    state: started
+  register: sshd_status
 
-- name: Restart SSH daemon
-  service:
-      name: sshd
-      state: restarted
-  when: sshd_config.changed
+- block:
+    - name: Disable SSH password auth
+      lineinfile:
+        dest: /etc/ssh/sshd_config
+        regexp: '^PasswordAuthentication\s*yes'
+        line: "PasswordAuthentication no"
+      register: sshd_config
+
+    - name: Restart SSH daemon
+      service:
+        name: sshd
+        state: restarted
+      when: sshd_config.changed
+  when: sshd_status.status.ActiveState == 'active'