Use proper variable precedence for configuratil file variables

defaults/main.yml

@@ -43,15 +43,15 @@ sshd: {}
 
 # The path to sshd_config file. This is useful when creating an included
 # configuration file snippet or configuring second sshd service
-sshd_config_file: /etc/ssh/sshd_config
+sshd_config_file: "{{ __sshd_config_file | default('/etc/ssh/sshd_config') }}"
 
 ### VARS DEFAULTS
 ### The following are defaults for OS specific configuration in var files in
 ### this role. They should not be set directly by role users.
 sshd_packages: []
-sshd_config_owner: root
+sshd_config_owner: "{{ __sshd_config_owner | default('root') }}"
-sshd_config_group: root
+sshd_config_group: "{{ __sshd_config_group | default('root') }}"
-sshd_config_mode: "0600"
+sshd_config_mode: "{{ __sshd_config_mode | default('0600') }}"
 sshd_binary: /usr/sbin/sshd
 sshd_service: sshd
 sshd_sftp_server: /usr/lib/openssh/sftp-server

vars/AIX.yml

@@ -1,10 +1,10 @@
 ---
-sshd_config_mode: '0644'
+__sshd_config_mode: '0644'
 # sshd is not installed by yum / AIX toolbox for Linux.
 # You'll need to manually install them using AIX Web Download Packs.
 sshd_packages: []
 sshd_sftp_server: /usr/sbin/sftp-server
-sshd_config_group: system
+__sshd_config_group: system
 __sshd_defaults:
   Subsystem: "sftp {{ sshd_sftp_server }}"
 __sshd_os_supported: yes

vars/Amazon.yml

@@ -1,5 +1,5 @@
 ---
-sshd_config_mode: '0644'
+__sshd_config_mode: '0644'
 sshd_packages:
   - openssh
   - openssh-server

vars/Debian.yml

@@ -2,7 +2,7 @@
 sshd_service: ssh
 sshd_packages:
   - openssh-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   Port: 22
   Protocol: 2

vars/Debian_10.yml

@@ -3,7 +3,7 @@ sshd_service: ssh
 sshd_packages:
   - openssh-server
   - openssh-sftp-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   ChallengeResponseAuthentication: no
   X11Forwarding: yes

vars/Debian_8.yml

@@ -3,7 +3,7 @@ sshd_service: ssh
 sshd_packages:
   - openssh-server
   - openssh-sftp-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   Port: 22
   Protocol: 2

vars/Debian_9.yml

@@ -3,7 +3,7 @@ sshd_service: ssh
 sshd_packages:
   - openssh-server
   - openssh-sftp-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   ChallengeResponseAuthentication: no
   X11Forwarding: yes

vars/Fedora.yml

@@ -6,7 +6,7 @@ sshd_sftp_server: /usr/libexec/openssh/sftp-server
 # Fedora 32 ships with drop-in directory support so we touch
 # just included file with highest priority by default and have
 # empty defaults
-sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf
+__sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf
 __sshd_defaults:
 __sshd_os_supported: yes
 __sshd_hostkey_group: ssh_keys

vars/FreeBSD.yml

@@ -1,6 +1,6 @@
 ---
-sshd_config_group: wheel
+__sshd_config_group: wheel
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 sshd_sftp_server: /usr/libexec/sftp-server
 __sshd_defaults:
   Subsystem: "sftp {{ sshd_sftp_server }}"

vars/OpenBSD.yml

@@ -1,6 +1,6 @@
 ---
-sshd_config_group: wheel
+__sshd_config_group: wheel
-sshd_config_mode: "0600"
+__sshd_config_mode: "0600"
 sshd_sftp_server: /usr/libexec/sftp-server
 __sshd_defaults:
   AuthorizedKeysFile: .ssh/authorized_keys

vars/Ubuntu_12.yml

@@ -2,7 +2,7 @@
 sshd_service: ssh
 sshd_packages:
   - openssh-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   Port: 22
   Protocol: 2

vars/Ubuntu_14.yml

@@ -3,7 +3,7 @@ sshd_service: ssh
 sshd_packages:
   - openssh-server
   - openssh-sftp-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   Port: 22
   Protocol: 2

vars/Ubuntu_16.yml

@@ -3,7 +3,7 @@ sshd_service: ssh
 sshd_packages:
   - openssh-server
   - openssh-sftp-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   Port: 22
   Protocol: 2

vars/Ubuntu_18.yml

@@ -3,7 +3,7 @@ sshd_service: ssh
 sshd_packages:
   - openssh-server
   - openssh-sftp-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   PasswordAuthentication: no
   ChallengeResponseAuthentication: no

vars/Ubuntu_20.yml

@@ -3,7 +3,7 @@ sshd_service: ssh
 sshd_packages:
   - openssh-server
   - openssh-sftp-server
-sshd_config_mode: "0644"
+__sshd_config_mode: "0644"
 __sshd_defaults:
   ChallengeResponseAuthentication: no
   UsePAM: yes