Disable SSH password auth in the common role only when sshd is active

common/tasks/ssh.yml

@@ -1,12 +1,20 @@
-- name: Disable SSH password auth
+- name: Check if SSH daemon is active
-  lineinfile:
+  systemd:
-      dest: /etc/ssh/sshd_config
+    name: sshd
-      regexp: '^PasswordAuthentication\s*yes'
+    state: started
-      line: "PasswordAuthentication no"
+  register: sshd_status
-  register: sshd_config
 
-- name: Restart SSH daemon
+- block:
-  service:
+    - name: Disable SSH password auth
-      name: sshd
+      lineinfile:
-      state: restarted
+        dest: /etc/ssh/sshd_config
-  when: sshd_config.changed
+        regexp: '^PasswordAuthentication\s*yes'
+        line: "PasswordAuthentication no"
+      register: sshd_config
+
+    - name: Restart SSH daemon
+      service:
+        name: sshd
+        state: restarted
+      when: sshd_config.changed
+  when: sshd_status.status.ActiveState == 'active'