From ca02faf7487d19f62b5e4b7f62d7829836726829 Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Thu, 30 Jul 2026 01:38:49 +0200
Subject: [PATCH] fix(sshd_config.j2): update condition for SFTP subsystem
 configuration to use common variable

---
 roles/common/tasks/users-systemfiles.yml      | 112 ++++++++++--------
 roles/common/templates/etc/ssh/sshd_config.j2 |   2 +-
 2 files changed, 66 insertions(+), 48 deletions(-)

diff --git a/roles/common/tasks/users-systemfiles.yml b/roles/common/tasks/users-systemfiles.yml
index 69a93a5..566d8e2 100644
--- a/roles/common/tasks/users-systemfiles.yml
+++ b/roles/common/tasks/users-systemfiles.yml
@@ -6,11 +6,12 @@
 # default_users
 - name: (users-systemfiles.yml) Check if local template directory exists for default users
   ansible.builtin.stat:
-    path: "{{ inventory_dir }}/files/homedirs/{{ item.name }}"
+    path: "{{ inventory_dir }}/files/homedirs/{{ user.name }}"
   delegate_to: localhost
-  with_items: "{{ default_user }}"
+  loop: "{{ default_user }}"
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
   register: common_local_template_dir_default_user
 
 # root
@@ -26,34 +27,37 @@
 
 - name: (users-systemfiles.yml) Check if users file '.bashrc.ORIG' exists
   ansible.builtin.stat:
-    path: "~{{ item.name }}/.bashrc.ORIG"
+    path: "~{{ user.name }}/.bashrc.ORIG"
   register: common_bashrc_user_orig_exists
   loop: "{{ default_user }}"
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
   tags:
     - bash
 
 - name: (users-systemfiles.yml) Backup existing users .bashrc file
   ansible.builtin.command:
-    cmd: cp -a ~{{ item.item.name }}/.bashrc ~{{ item.item.name }}/.bashrc.ORIG
-    creates: "~{{ item.item.name }}/.bashrc.ORIG"
-  loop: "{{ common_bashrc_user_orig_exists.results }}"
+    cmd: cp -a ~{{ user_pair.0.name }}/.bashrc ~{{ user_pair.0.name }}/.bashrc.ORIG
+    creates: "~{{ user_pair.0.name }}/.bashrc.ORIG"
+  loop: "{{ default_user | zip(common_bashrc_user_orig_exists.results) | list }}"
   loop_control:
-    label: "{{ item.item.name }}"
+    loop_var: user_pair
+    label: "{{ user_pair.0.name }}"
   tags:
     - bash
 
 # 1. Prüfen, ob für jeden User ein lokales _bashrc existiert
 - name: (users-systemfiles.yml) stat user _bashrc
   ansible.builtin.stat:
-    path: "{{ inventory_dir }}/files/homedirs/{{ item.name }}/_bashrc"
+    path: "{{ inventory_dir }}/files/homedirs/{{ user.name }}/_bashrc"
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
   register: common_bashrc_stats
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
 
 # 2. Falls vorhanden, Datei kopieren
 - name: (users-systemfiles.yml) copy .bashrc if it exists
@@ -65,12 +69,13 @@
     mode: "0644"
   loop: "{{ default_user | zip(common_bashrc_stats.results) | list }}"
   loop_control:
+    loop_var: user_stat
     label: "{{ user.name }}"
   when:
     - stat_result.stat.exists
   vars:
-    user: "{{ item.0 }}"
-    stat_result: "{{ item.1 }}"
+    user: "{{ user_stat.0 }}"
+    stat_result: "{{ user_stat.1 }}"
   tags:
     - bash
 
@@ -119,11 +124,12 @@
 
 - name: (users-systemfiles.yml) Check if users file '.profile.ORIG' exists
   ansible.builtin.stat:
-    path: "~{{ item.name }}/.profile.ORIG"
+    path: "~{{ user.name }}/.profile.ORIG"
   register: common_profile_user_orig_exists
   loop: "{{ default_user }}"
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
@@ -131,11 +137,12 @@
 
 - name: (users-systemfiles.yml) Backup existing users .profile file
   ansible.builtin.command:
-    cmd: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
-    creates: "~{{ item.item.name }}/.profile.ORIG"
-  loop: "{{ common_profile_user_orig_exists.results }}"
+    cmd: cp -a ~{{ user_pair.0.name }}/.profile ~{{ user_pair.0.name }}/.profile.ORIG
+    creates: "~{{ user_pair.0.name }}/.profile.ORIG"
+  loop: "{{ default_user | zip(common_profile_user_orig_exists.results) | list }}"
   loop_control:
-    label: "{{ item.item.name }}"
+    loop_var: user_pair
+    label: "{{ user_pair.0.name }}"
   when:
     - ansible_facts['distribution'] == "Debian"
   tags:
@@ -144,13 +151,14 @@
 # 1. Prüfen, ob für jeden User ein lokales _profile existiert
 - name: (users-systemfiles.yml) stat user _profile
   ansible.builtin.stat:
-    path: "{{ inventory_dir }}/files/homedirs/{{ item.name }}/_profile"
+    path: "{{ inventory_dir }}/files/homedirs/{{ user.name }}/_profile"
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
   register: common_profile_stats
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
 
 # 2. Falls vorhanden, Datei kopieren
 - name: (users-systemfiles.yml) copy .profile if it exists
@@ -162,12 +170,13 @@
     mode: "0644"
   loop: "{{ default_user | zip(common_profile_stats.results) | list }}"
   loop_control:
+    loop_var: user_stat
     label: "{{ user.name }}"
   when:
     - stat_result.stat.exists
   vars:
-    user: "{{ item.0 }}"
-    stat_result: "{{ item.1 }}"
+    user: "{{ user_stat.0 }}"
+    stat_result: "{{ user_stat.1 }}"
   tags:
     - bash
 
@@ -220,11 +229,12 @@
 
 - name: (users-systemfiles.yml) Check if users file '.bash_profile.ORIG' exists
   ansible.builtin.stat:
-    path: "~{{ item.name }}/.bash_profile.ORIG"
+    path: "~{{ user.name }}/.bash_profile.ORIG"
   register: common_bash_profile_user_orig_exists
   loop: "{{ default_user }}"
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
   when:
     - ansible_facts['distribution'] == "CentOS"
   tags:
@@ -232,11 +242,12 @@
 
 - name: (users-systemfiles.yml) Backup existing users .bash_profile file
   ansible.builtin.command:
-    cmd: cp -a ~{{ item.item.name }}/.bash_profile ~{{ item.item.name }}/.bash_profile.ORIG
-    creates: "~{{ item.item.name }}/.bash_profile.ORIG"
-  loop: "{{ common_bash_profile_user_orig_exists.results }}"
+    cmd: cp -a ~{{ user_pair.0.name }}/.bash_profile ~{{ user_pair.0.name }}/.bash_profile.ORIG
+    creates: "~{{ user_pair.0.name }}/.bash_profile.ORIG"
+  loop: "{{ default_user | zip(common_bash_profile_user_orig_exists.results) | list }}"
   loop_control:
-    label: "{{ item.item.name }}"
+    loop_var: user_pair
+    label: "{{ user_pair.0.name }}"
   when:
     - ansible_facts['distribution'] == "CentOS"
   tags:
@@ -245,13 +256,14 @@
 # 1. Prüfen, ob für jeden User ein lokales _bash_profile existiert
 - name: (users-systemfiles.yml) stat user _bash_profile
   ansible.builtin.stat:
-    path: "{{ inventory_dir }}/files/homedirs/{{ item.name }}/_bash_profile"
+    path: "{{ inventory_dir }}/files/homedirs/{{ user.name }}/_bash_profile"
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
   register: common_bash_profile_stats
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
   when:
     - ansible_facts['distribution'] == "CentOS"
 
@@ -265,13 +277,14 @@
     mode: "0644"
   loop: "{{ default_user | zip(common_bash_profile_stats.results) | list }}"
   loop_control:
+    loop_var: user_stat
     label: "{{ user.name }}"
   when:
     - ansible_facts['distribution'] == "CentOS"
     - stat_result.stat.exists
   vars:
-    user: "{{ item.0 }}"
-    stat_result: "{{ item.1 }}"
+    user: "{{ user_stat.0 }}"
+    stat_result: "{{ user_stat.1 }}"
   tags:
     - bash
 
@@ -329,13 +342,14 @@
 # 1. Prüfen, ob für jeden User ein lokales _vimrc existiert
 - name: (users-systemfiles.yml) stat user _vimrc
   ansible.builtin.stat:
-    path: "{{ inventory_dir }}/files/homedirs/{{ item.name }}/_vimrc"
+    path: "{{ inventory_dir }}/files/homedirs/{{ user.name }}/_vimrc"
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
   register: common_vimrc_stats
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
 
 # 2. Falls vorhanden, Datei kopieren
 - name: (users-systemfiles.yml) copy .vimrc if it exists
@@ -347,25 +361,27 @@
     mode: "0644"
   loop: "{{ default_user | zip(common_vimrc_stats.results) | list }}"
   loop_control:
+    loop_var: user_stat
     label: "{{ user.name }}"
   when:
     - stat_result.stat.exists
   vars:
-    user: "{{ item.0 }}"
-    stat_result: "{{ item.1 }}"
+    user: "{{ user_stat.0 }}"
+    stat_result: "{{ user_stat.1 }}"
   tags:
     - bash
 
 # 1) Lokal prüfen, ob ~/.vim existiert
 - name: (users-systemfiles.yml) stat local .vim for each user
   ansible.builtin.stat:
-    path: "{{ inventory_dir }}/files/homedirs/{{ item.name }}/.vim"
+    path: "{{ inventory_dir }}/files/homedirs/{{ user.name }}/.vim"
   delegate_to: localhost
   become: false
   loop: "{{ default_user }}"
   register: common_dotvim_stats
   loop_control:
-    label: "{{ item.name }}"
+    loop_var: user
+    label: "{{ user.name }}"
 
 # 2) Wenn vorhanden, .vim-Verzeichnis ins Home des Users kopieren
 - name: (users-systemfiles.yml) copy .vim directory if it exists
@@ -375,14 +391,15 @@
     dest: "~{{ user.name }}/"
     mode: preserve # oder weglassen; 0644 wäre für Verzeichnisse falsch
   become: true
-  loop: "{{ default_user | zip(dotvim_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
   loop_control:
+    loop_var: user_stat
     label: "{{ user.name }}"
   when:
     - stat_result.stat.exists | bool
   vars:
-    user: "{{ item.0 }}"
-    stat_result: "{{ item.1 }}"
+    user: "{{ user_stat.0 }}"
+    stat_result: "{{ user_stat.1 }}"
   tags: [vim]
 
 
@@ -395,14 +412,15 @@
     recurse: true
     state: directory
   become: true
-  loop: "{{ default_user | zip(dotvim_stats.results) | list }}"
+  loop: "{{ default_user | zip(common_dotvim_stats.results) | list }}"
   loop_control:
+    loop_var: user_stat
     label: "{{ user.name }}"
   when:
     - stat_result.stat.exists | bool
   vars:
-    user: "{{ item.0 }}"
-    stat_result: "{{ item.1 }}"
+    user: "{{ user_stat.0 }}"
+    stat_result: "{{ user_stat.1 }}"
   tags: [vim]
 
 # --
@@ -448,7 +466,7 @@
     mode: preserve # oder weglassen; nicht 0644 bei Verzeichnissen
   become: true
   when:
-    - root_dotvim_stat.stat.exists | bool
+    - common_root_dotvim_stat.stat.exists | bool
   tags: [vim]
 
 # 3) Ownership sicherstellen (rekursiv)
@@ -461,5 +479,5 @@
     state: directory
   become: true
   when:
-    - root_dotvim_stat.stat.exists | bool
+    - common_root_dotvim_stat.stat.exists | bool
   tags: [vim]
diff --git a/roles/common/templates/etc/ssh/sshd_config.j2 b/roles/common/templates/etc/ssh/sshd_config.j2
index 1360fca..0f28ced 100644
--- a/roles/common/templates/etc/ssh/sshd_config.j2
+++ b/roles/common/templates/etc/ssh/sshd_config.j2
@@ -272,7 +272,7 @@ AcceptEnv LANG LC_*
 # Configures an external subsystem (e.g. file transfer daemon).
 # By default no subsystems are defined.
 {% if ansible_facts['distribution'] == "Debian" and ansible_facts['distribution_major_version'] | int >= 11 %}
-{% if sshd_config_sftp.found|int == 0 %}
+{% if common_sshd_config_sftp.found|int == 0 %}
 Subsystem sftp /usr/lib/openssh/sftp-server
 {% else %}
 #Subsystem sftp /usr/lib/openssh/sftp-server