Role common: add task sftpd.yml for chrooted SFTP access.

- group 'sftpusers' (GID 200 or next free), sshd drop-in
  /etc/ssh/sshd_config.d/90-sshd-SFTP.conf (Match Group, ChrootDirectory %h,
  ForceCommand internal-sftp), PasswordAuthentication via
  'sftp_password_authentication'
- new sftp users (UID 201 or next free) with root owned chroot home,
  upload dir and root owned authorized_keys (always created)
- existing users (e.g. www-data, suexec users) can be added to the group;
  chroot requirements of their home are checked, not changed
- passwords: update_password defaults to 'always', password of users with
  shell access is never changed
- controlled by 'chrooted_sftpd_present' (default: false), tag 'sftpd'
- add empty sftpd section to all host_vars *-common.yml

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

group_vars/all/main.yml

@@ -2473,6 +2473,99 @@ sshd_pasword_auth_user:
 sshd_pasword_auth_ip:
 
 
+# ---
+# vars used by roles/common/tasks/sftpd.yml
+# ---
+
+# Set up chrooted SFTP access (group, sshd config, sftp users)?
+#
+chrooted_sftpd_present: false
+
+# Group for chrooted sftp users. GID is 'sftp_group_id_start' if still
+# free, otherwise the next free GID above.
+#
+sftp_group_name: sftpusers
+sftp_group_id_start: 200
+
+# New sftp users get UID 'sftp_user_id_start' or the next free UID above
+# (unless 'user_id' is given explicitly). Existing users keep their UID.
+#
+sftp_user_id_start: 201
+
+# Allow password authentication for members of the sftp group?
+# (overrides the global sshd setting for this group)
+#
+sftp_password_authentication: !!str "no"
+
+# sftp users
+#
+# New users (will be created):
+#
+#   name:            user name                                  (required)
+#   home:            home = chroot directory, owned by root     (required)
+#   ssh_keys:        list of public keys (authorized_keys)      (optional, default: [])
+#   password:        password hash (e.g. 'mkpasswd -m yescrypt') (optional, default: '!' = locked)
+#   update_password: always | on_create                         (optional, default: always)
+#   upload_dir:      writable directory inside chroot           (optional, default: upload)
+#   user_id:         fixed UID                                  (optional)
+#
+#   <home>/.ssh/authorized_keys is always created (owned by root) - it
+#   is empty, if no ssh_keys are given.
+#
+#   Note: with 'update_password: always' (default) the password hash given
+#         here is enforced on every run - without 'password' the account
+#         gets locked ('!'). With 'on_create' the password is only set when
+#         the user is created.
+#
+#   If the user already exists with shell access (shell other than
+#   nologin/false), the play fails for the host - use 'existing_user: true'.
+#
+# Existing users (e.g. www-data or suexec users of vhosts), only added to
+# the sftp group:
+#
+#   name:           user name                                  (required)
+#   existing_user:  true                                       (required)
+#   ssh_keys:       public keys, added to the users            (optional)
+#                   ~/.ssh/authorized_keys
+#   password:       password hash                              (optional, default: unchanged)
+#   update_password: always | on_create                        (optional, default: always)
+#
+#   ~/.ssh and ~/.ssh/authorized_keys are always created (owned by the
+#   user), an existing authorized_keys is never truncated. Without
+#   'password' the password stays untouched.
+#
+#   UID, primary group, home and shell stay untouched, 'home' is ignored.
+#   The home directory (from /etc/passwd) becomes the chroot directory, so
+#   it and all its parents must be owned by root and not writable by
+#   group/others (e.g. /var/www owned by root:root, mode 0755). This is
+#   checked - the play fails for the host otherwise - but never changed.
+#
+#   ATTENTION: A user in the sftp group has NO shell access anymore
+#              (ForceCommand internal-sftp).
+#
+# Note: ssh_keys are optional. Without key and without password (and with
+#       'sftp_password_authentication: no') the user can't log in.
+#
+# Note: The password of a user with shell access (login shell other than
+#       nologin/false) is NEVER changed, regardless of 'password' and
+#       'update_password'.
+#
+# example:
+#
+#   sftp_user:
+#     - name: sftp-test
+#       home: /data/sftp/sftp-test
+#       ssh_keys:
+#         - 'ssh-ed25519 AAAA... user@host'
+#
+#     - name: www-data
+#       existing_user: true
+#       ssh_keys:
+#         - 'ssh-ed25519 AAAA... user@host'
+#
+sftp_user: []
+
+
 # ---
 # vars used by roles/common/tasks/sudoers.yml
 # ---