---
- name: Installer openssh-server
  ansible.builtin.apt:
    name: openssh-server
    state: present

- name: Créer le répertoire sshd_config.d
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Déployer la configuration SSH Set-OPS
  ansible.builtin.template:
    src: 10-setops.conf.j2
    dest: /etc/ssh/sshd_config.d/10-setops.conf
    owner: root
    group: root
    mode: "0644"
  notify: Validate and reload ssh

- name: Activer et démarrer SSH
  ansible.builtin.systemd:
    name: ssh
    enabled: true
    state: started

# Voir defaults/main.yml pour le raisonnement (etat par entree, pas d'`exclusive`).
- name: Autoriser — ou révoquer — les clés d'administration déclarées au plan
  ansible.posix.authorized_key:
    user: "{{ ssh_baseline_admin_user }}"
    key: "{{ item.cle }}"
    state: "{{ item.etat | default('present') }}"
    comment: "{{ item.pourquoi | default(omit) }}"
  loop: "{{ ssh_baseline_cles_admin }}"
  loop_control:
    label: "{{ item.pourquoi | default(item.cle[:40]) }} → {{ item.etat | default('present') }}"
  when: not ansible_check_mode