- name: Nuke lines for idempotency
  lineinfile:
    dest: /etc/ssh/sshd_config 
    regexp: "{{ item }}"
    state: absent
  loop:
    - "^PermitRootLogin"
    - "^PasswordAuthentication"

- name: disable root SSH access
  lineinfile:
    dest: /etc/ssh/sshd_config 
    regexp: "^PermitRootLogin"
    line: "PermitRootLogin no"
    state: present
  notify:
    - restart sshd
 
- name: disable SSH password authentication
  lineinfile:
    dest: /etc/ssh/sshd_config
    regexp: "^PasswordAuthentication"
    line: "PasswordAuthentication no"
    state: present
  notify:
    - restart sshd

# Nicked from: https://relativkreativ.at/articles/how-to-use-ansibles-lineinfile-module-in-a-bulletproof-way

- name: Nuke lines for idempotency
  lineinfile:
    dest: /etc/ssh/sshd_config 
    regexp: "{{ item }}"
    state: absent
  loop:
    - "^PermitRootLogin"
    - "^PasswordAuthentication"

- name: disable root SSH access
  lineinfile:
    dest: /etc/ssh/sshd_config 
    regexp: "^PermitRootLogin"
    line: "PermitRootLogin no"
    state: present
  notify:
    - restart sshd
 
- name: disable SSH password authentication
  lineinfile:
    dest: /etc/ssh/sshd_config
    regexp: "^PasswordAuthentication"
    line: "PasswordAuthentication no"
    state: present
  notify:
    - restart sshd

Add hint for lineinfile idempotency
Add hint for lineinfile idempotency
