---
- name: Replace default 2048 bits RSA keypair
  community.crypto.openssh_keypair:
    state: present
    type: rsa
    size: "{{ ssh_host_rsa_key_size }}"
    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
    force: false
    regenerate: partial_idempotence

- name: Set hostkeys according to openssh-version if openssh >= 5.3
  ansible.builtin.set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
  when: sshd_version is version('5.3', '>=')

- name: Set hostkeys according to openssh-version if openssh >= 6.0
  ansible.builtin.set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
      - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
  when: sshd_version is version('6.0', '>=')

- name: Set hostkeys according to openssh-version if openssh >= 6.3
  ansible.builtin.set_fact:
    ssh_host_key_files:
      - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
      - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
      - "{{ ssh_host_keys_dir }}/ssh_host_ed25519_key"
  when: sshd_version is version('6.3', '>=')

- name: Change host private key ownership, group and permissions
  ansible.builtin.file:
    path: "{{ item }}"
    owner: "{{ ssh_host_keys_owner }}"
    group: "{{ ssh_host_keys_group }}"
    mode: "{{ ssh_host_keys_mode }}"
  loop: "{{ ssh_host_key_files }}"