{% set ssh_allow_users = salt['pillar.get']('pmg:ssh_allow_users', []) %}
{% set ssh_password_authentication = salt['pillar.get']('pmg:ssh_password_authentication', True) %}

pmg-sshd-dropin-dir:
  file.directory:
    - name: /etc/ssh/sshd_config.d
    - user: root
    - group: root
    - mode: '0755'

pmg-sshd-hardening-config:
  file.managed:
    - name: /etc/ssh/sshd_config.d/99-hardening.conf
    - source: salt://pmg/files/99-hardening.conf.jinja
    - template: jinja
    - context:
        ssh_allow_users: {{ ssh_allow_users }}
        ssh_password_authentication: {{ ssh_password_authentication }}
    - user: root
    - group: root
    - mode: '0644'

pmg-validate-sshd-config:
  cmd.run:
    - name: sshd -t
    - onchanges:
      - file: pmg-sshd-hardening-config

pmg-sshd-service:
  service.running:
    - name: ssh
    - enable: true
    - reload: true
    - watch:
      - cmd: pmg-validate-sshd-config