Update ..

roles/common/tasks/main.yml

@@ -10,13 +10,6 @@
     - basic
 
 
-# tags supported inside sshd.yml
-#
-#    sshd-config
-- import_tasks: sshd.yml
-  tags: sshd
-
-
 # tags supported inside apt.yml
 #
 #   apt-update
@@ -75,6 +68,13 @@
     - webadmin
 
 
+# tags supported inside sshd.yml
+#
+#    sshd-config
+- import_tasks: sshd.yml
+  tags: sshd
+
+
 # tags supported inside sudoers.yml:
 #
 #   sudoers-remove

roles/common/tasks/sshd.yml

@@ -13,7 +13,21 @@
   tags:
     - sshd-config
 
-- name: (sshd.yml) Create new sshd_config from template sshd_config.j2
+- name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2
+  template:
+    src: etc/ssh/sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: 0644
+    validate: 'sshd -f %s -T'
+  notify: "Restart ssh"
+  when:
+    - create_sftp_group is defined and not create_sftp_group
+  tags:
+    - sshd-config
+
+- name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2
   template:
     src: etc/ssh/sshd_config.j2
     dest: /etc/ssh/sshd_config
@@ -21,8 +35,9 @@
     group: root
     mode: 0644
     validate: 'sshd -f %s -T -C user=sftp_users'
-    #backup: yes
   notify: "Restart ssh"
+  when:
+    - create_sftp_group is defined and create_sftp_group
   tags:
     - sshd-config