Add GitLab sshd config and disable ipv6

README.md

@@ -12,7 +12,7 @@ This role initializes a server with the following actions :
 Requirements
 ------------
 
-This role mostly uses ansible.builtin module but also authorized_key from ansible.posix collection
+This role mostly uses mainly ansible.builtin modules but also authorized_key and sysctl from ansible.posix collection
 
 Role Variables
 --------------
@@ -34,6 +34,7 @@ Variables from vars directory (OS specific):
   * users_to_remove : list of users to remove from default delivered servers
 * Global :
   * default_ssh_public_keys : ssh_public_key + extra_public_key (if exists)
+  * sysctl_disable_ipv6_keys : sysctl entries to activate to disable ipv6
 
 This role also makes use of variables gathered from facts :
 * ansible_os_family : Family of Operating System (Debian or RedHat)

tasks/main.yml

@@ -156,6 +156,13 @@
       export TMOUT
   when: ansible_os_family == "RedHat"
 
+- name: disable ipv6
+  sysctl:
+    name: "{{ item }}"
+    value: '1'
+    sysctl_set: true
+  with_items: "{{ sysctl_disable_ipv6_keys }}"
+
 - name: Check if backup servers present in root known hosts
   lineinfile:
     path: /root/.ssh/known_hosts

templates/sshd_config.j2

@@ -10,6 +10,9 @@ LogLevel VERBOSE
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
 PasswordAuthentication no
 PermitRootLogin no
+{% if inventory_hostname in groups.gitlab %}
+Port 22
+{% endif %}
 Port {{ default_sshd_port }}
 PrintMotd no
 Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO
@@ -25,5 +28,5 @@ Match Group sftpgroup
       GatewayPorts no
       X11Forwarding no
 {% else %}
-AllowUsers {{ host_user }}{% if host_user2 is defined %} {{ host_user2 }}{% endif %}
+AllowUsers {{ host_user }}{% if host_user2 is defined %} {{ host_user2 }}{% endif %}{% if inventory_hostname in groups.gitlab %} git{% endif %}
 {% endif %}

vars/main.yml

 ---
 default_ssh_public_keys: "{{ ssh_public_key }}{% if extra_public_key is defined %} \n {{ extra_public_key }}{% endif %}"
+sysctl_disable_ipv6_keys:
+  - net.ipv6.conf.all.disable_ipv6
+  - net.ipv6.conf.default.disable_ipv6
+  - net.ipv6.conf.lo.disable_ipv6