vn-ansible/roles/debian-once/tasks/ssh.yml

- name: Generate a new SSH key pair
  openssh_keypair:
    path: /etc/ssh/ssh_host_rsa_key
    type: rsa                        
    size: 4096
  register: new_pair                                   
- name: Configure sshd_config settings
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "{{ item.regexp }}"
    line: "{{ item.line }}"
  loop:
    - { regexp: '^#ListenAddress 0.0.0.0', line: 'ListenAddress 0.0.0.0' }
    - { regexp: '^#SyslogFacility AUTH', line: 'SyslogFacility AUTH' }
- name: Delete old host SSH keys
  file:
    path: "{{ item }}"
    state: absent
  with_items:
    - /etc/ssh/ssh_host_ecdsa_key
    - /etc/ssh/ssh_host_ecdsa_key.pub
    - /etc/ssh/ssh_host_ed25519_key
    - /etc/ssh/ssh_host_ed25519_key.pub
  when: new_pair is succeeded