---
- include: firewalld.yml
  sudo: true
  when: secure_firewalld
- include: sshd.yml
  sudo: true
  when: secure_ssh
- include: fail2ban.yml
  sudo: true
  when: secure_fail2ban

# ipv6? Check it if you have it.
- include: ipv6.yml
  sudo: true
  when: ansible_default_ipv6 != {} and secure_ipv6

- name: Add SSH keys from github
  authorized_key: user=ryansb key=https://github.com/ryansb.keys
  when: ansible_user_id == "ryansb"

- name: Add root SSH keys
  authorized_key: user=root key=https://github.com/ryansb.keys
  sudo: true

---
- include: firewalld.yml
  sudo: true
  when: secure_firewalld
- include: sshd.yml
  sudo: true
  when: secure_ssh
- include: fail2ban.yml
  sudo: true
  when: secure_fail2ban

# ipv6? Check it if you have it.
- include: ipv6.yml
  sudo: true
  when: ansible_default_ipv6 != {} and secure_ipv6

- name: Add SSH keys from github
  authorized_key: user=ryansb key=https://github.com/ryansb.keys
  when: ansible_user_id == "ryansb"

- name: Add root SSH keys
  authorized_key: user=root key=https://github.com/ryansb.keys
  sudo: true

- name: Trust internal CA
  copy:
    content: "{{ lookup('file', 'ryansb.com.pem') }}"
    dest: /etc/pki/ca-trust/source/anchors/ryansb.com.pem
    owner: root
    group: root
    mode: "0644"
  sudo: true
- name: load cert into trust store
  shell: update-ca-trust
  become: true

Add internal CA trust to trust anchors list
Add internal CA trust to trust anchors list
