---

- name: Copy CA SSH key to server.
  copy:
    src: ca.pub
    dest: /etc/ssh
    group: root
    owner:  root
    mode: 644

- name: Harden /etc/ssh/sshd_config
  template:
    src: sshd_config_template.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: 0644
  notify:
    - restart sshd

---

- name: Copy CA SSH key to server.
  sudo: yes
  copy:
    src: ca.pub
    dest: /etc/ssh
    group: root
    owner:  root
    mode: 644

- name: Harden /etc/ssh/sshd_config
  sudo: yes
  template:
    src: sshd_config_template.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: 0644
  notify:
    - restart sshd

Add sudo to copy CA key role.
Add sudo to copy CA key role.

Without sudo a repeated play breaks here with permission errors.
