---
- name: Manage root login
  hosts: all
  tasks:
    - name: Configure sshd to prevent root and password login except from particular subnet
      ansible.builtin.include_role:
        name: fedora.linux_system_roles.sshd
      vars:
        sshd_config:
      # root login and password login is enabled only from a particular subnet
          PermitRootLogin: false
          PasswordAuthentication: false
          Match:
            - Condition: "Address 192.0.2.0/24"
              PermitRootLogin: true
              PasswordAuthentication: true
