host_vars/aur.archlinux.org/misc

 filesystem: btrfs
 memcached_socket: "/run/memcached/aurweb.sock"
+sshd_enable_includes: true
 wireguard_address: 10.0.0.2
 wireguard_public_key: TPLeGQ7qU6ZNtcgDbEV0SSYScvK+XS5igcPdGSXo6UA=

playbooks/all-hosts-basic.yml

@@ -5,8 +5,7 @@
     - { role: common }
     - { role: firewalld }
     - { role: wireguard }
-    # reconfiguring sshd may break the AUR on luna (unchecked)
-    # - { role: sshd, tags: ['sshd'] }
+    - { role: sshd }
     - { role: root_ssh }
     - { role: borg_client, tags: ["borg"], when: "'borg_clients' in group_names" }
     - { role: hardening }

playbooks/aur.archlinux.org.yml

@@ -3,7 +3,7 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: sshd, sshd_enable_includes: true }
+    - { role: sshd }
     - { role: root_ssh }
     - { role: prometheus_exporters }
     - { role: promtail }

roles/security_tracker/defaults/main.yml

-security_tracker_version: "03695574bc4c847c9bfdc45dab6cc98297c2a668"
+security_tracker_version: "e48779936313af83384b6c4602adb5c516bc9612"

roles/sshd/templates/sshd_config.j2

@@ -93,7 +93,7 @@ AllowTcpForwarding no
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
-PrintMotd no # pam does that
+PrintMotd no
 #PrintLastLog yes
 #TCPKeepAlive yes
 #PermitUserEnvironment no