sshd_config.j2

AcceptEnv LANG LC_*
AllowAgentForwarding no
AllowTcpForwarding no
AuthenticationMethods publickey
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
HostKey /etc/ssh/ssh_host_ed25519_key
KbdInteractiveAuthentication no
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256
LogLevel VERBOSE
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
PasswordAuthentication no
PermitRootLogin no
{% if inventory_hostname in groups.gitlab %}
Port 22
{% endif %}
Port {{ default_sshd_port }}
PrintMotd no
Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO
UsePAM yes
X11Forwarding no
{% if inventory_hostname in groups.backup_server %}
AllowUsers {{ host_user }}{% if host_user2 is defined %} {{ host_user2 }}{% endif %} {{ (groups.all | difference(groups.backup_server)) | map('extract', hostvars, ['backup_sftp_user']) | sort | join(" ") }}
AllowGroups {{ host_user }} sftpgroup
Match Group sftpgroup
      ChrootDirectory /backup/sftp
      ForceCommand internal-sftp
      AllowTcpForwarding no
      GatewayPorts no
      X11Forwarding no
{% else %}
AllowUsers {{ host_user }}{% if host_user2 is defined %} {{ host_user2 }}{% endif %}{% if inventory_hostname in groups.gitlab %} git{% endif %}
{% endif %}