---
- name: 👁️ Show shared diagnostics for failed SSH restart
  ansible.builtin.include_role:
    name: sys-service
    tasks_from: utils/debug.yml
  vars:
    system_service_debug_unit: "{{ sys_svc_sshd_service_unit }}"
    system_service_debug_context: |
      ansible_virtualization_type={{ ansible_facts['virtualization_type'] | default('unknown') }}
      ansible_virtualization_role={{ ansible_facts['virtualization_role'] | default('unknown') }}
      failed_msg={{ sys_svc_sshd_restart_result.msg | default('') }}
      failed_stderr={{ sys_svc_sshd_restart_result.stderr | default('') }}
      failed_result={{ sys_svc_sshd_restart_result | to_nice_json }}

- name: ✅ Validate sshd_config after failed restart
  ansible.builtin.command:
    argv:
      - sshd
      - -t
      - -f
      - "{{ SYS_SVC_SSHD_CONFIG_FILE }}"
  register: sys_svc_sshd_config_check
  changed_when: false
  failed_when: false

- name: 👁️ Show sshd_config validation after failed restart
  ansible.builtin.debug:
    msg: |
      === sshd -t -f {{ SYS_SVC_SSHD_CONFIG_FILE }} ===
      rc={{ sys_svc_sshd_config_check.rc | default('n/a') }}
      {{ sys_svc_sshd_config_check.stdout | default('') }}
      {{ sys_svc_sshd_config_check.stderr | default('') }}

- name: 🛑 Fail SSH restart on an invalid sshd_config
  ansible.builtin.fail:
    msg: >-
      Restart of {{ sys_svc_sshd_service_unit }} failed and
      sshd -t rejects {{ SYS_SVC_SSHD_CONFIG_FILE }} (rc={{ sys_svc_sshd_config_check.rc }}).
      See shared service diagnostics above and the validation output.
  when:
    - sys_svc_sshd_config_check.rc is defined
    - sys_svc_sshd_config_check.rc != 0