From 1f203c736caad65678c2e1794b4410643d1ecd55 Mon Sep 17 00:00:00 2001
From: Anton Vakhrushev <anwinged@ya.ru>
Date: Sun, 6 Sep 2026 16:14:48 +0300
Subject: [PATCH] =?UTF-8?q?system:=20root-=D0=BB=D0=BE=D0=B3=D0=B8=D0=BD?=
 =?UTF-8?q?=20=D0=BF=D0=BE=20SSH=20=D0=B7=D0=B0=D0=BF=D1=80=D0=B5=D1=89?=
 =?UTF-8?q?=D1=91=D0=BD,=20=D0=B2=D0=BA=D0=BB=D1=8E=D1=87=D0=B5=D0=BD?=
 =?UTF-8?q?=D1=8B=20=D0=B0=D0=B2=D1=82=D0=BE=D0=BE=D0=B1=D0=BD=D0=BE=D0=B2?=
 =?UTF-8?q?=D0=BB=D0=B5=D0=BD=D0=B8=D1=8F=20=D0=B1=D0=B5=D0=B7=D0=BE=D0=BF?=
 =?UTF-8?q?=D0=B0=D1=81=D0=BD=D0=BE=D1=81=D1=82=D0=B8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- security_ssh_permit_root_login: "no" — ansible ходит под major с become,
  root по SSH не нужен
- security_autoupdate_enabled: true — unattended-upgrades ставит только
  патчи из security-репозиториев, автоперезагрузка выключена
---
 playbook-system.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/playbook-system.yml b/playbook-system.yml
index 9434458..cb3283c 100644
--- a/playbook-system.yml
+++ b/playbook-system.yml
@@ -27,8 +27,13 @@
       ansible.builtin.import_role:
         name: geerlingguy.security
       vars:
-        security_ssh_permit_root_login: "yes"
-        security_autoupdate_enabled: "no"
+        # Root по SSH не нужен: ansible ходит под непривилегированным major с
+        # become. Заодно defense-in-depth — если PasswordAuthentication когда-то
+        # вернётся в "yes", root не откроется по паролю.
+        security_ssh_permit_root_login: "no"
+        # unattended-upgrades: шаблон роли ограничен security-репозиториями,
+        # автоматическая перезагрузка выключена дефолтом роли.
+        security_autoupdate_enabled: true
         security_fail2ban_enabled: true
 
     - name: "Copy keep files script"