workstation/roles/debian/tasks/ssh.yml

---
- name: Disable SSH passwords
  become: true
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?\w*PasswordAuthentication (yes|no)'
    line: 'PasswordAuthentication no'
  register: changed_ssh_config
- name: Enable SSH
  become: true
  ansible.builtin.systemd:
    name: ssh.service
    enabled: yes
    state: started
- name: Restart SSH
  become: true
  ansible.builtin.systemd:
    name: ssh.service
    state: restarted
  when: changed_ssh_config.changed == true