- name: Disable PasswordAuthentication
  vars:
    sshd_config_path: /etc/ssh/sshd_config
  tags:
    - ssh
  block:
    - name: Check if sshd_config exists
      ansible.builtin.stat:
        path: '{{ sshd_config_path }}'
      register: sshd_config_file

    - name: Copy initial sshd config
      when: not sshd_config_file.stat.exists
      ansible.builtin.copy:
        src: /usr/etc/ssh/sshd_config
        dest: '{{ sshd_config_path }}'
        remote_src: true
        mode: '640'

    - name: Disable PasswordAuthentication in sshd config
      ansible.builtin.lineinfile:
        path: '{{ sshd_config_path }}'
        regexp: "^[#]?\\s?PasswordAuthentication"
        line: "PasswordAuthentication no"
      register: disable_passwds

    - name: Restart service sshd
      when: disable_passwds.changed
      ansible.builtin.service:
        name: sshd
        state: restarted