---
- name: Install openssh
  become: true
  become_user: root
  become_method: sudo
  apt:
    package: openssh-server
    state: present

- name: Change SSHd port
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^Port"
    line: "Port {{ port }}"
  notify: "Restart sshd"

- name: Enable key auth
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^PubkeyAuthentication"
    line: "PubkeyAuthentication yes"
  notify: "Restart sshd"

- name: Disable password auth
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^PasswordAuthentication"
    line: "PasswordAuthentication no"
  notify: "Restart sshd"

- name: Disallow root login
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^PermitRootLogin"
    line: "PermitRootLogin no"
  notify: "Restart sshd"
...

---
- name: Install openssh
  become: true
  become_user: root
  become_method: sudo
  apt:
    package: openssh-server
    state: present

- name: Change SSHd port
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^Port"
    line: "Port {{ sshd_port }}"
  notify: "Restart sshd"
  when: sshd_port is defined

- name: Enable key auth
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^PubkeyAuthentication"
    line: "PubkeyAuthentication yes"
  notify: "Restart sshd"

- name: Disable password auth
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^PasswordAuthentication"
    line: "PasswordAuthentication no"
  notify: "Restart sshd"

- name: Disallow root login
  become: true
  become_user: root
  become_method: sudo
  lineinfile:
    dest: "/etc/ssh/sshd_config"
    regexp: "^PermitRootLogin"
    line: "PermitRootLogin no"
  notify: "Restart sshd"
...

Allow for not specifying the SSH port in configure-sshd role
Allow for not specifying the SSH port in configure-sshd role
