set remote user and port in all. override in firstrun

group_vars/all/main.yml

@@ -2,11 +2,9 @@
 # Vars for every VPS in the fleet. Keep this file plaintext and readable
 # in diffs - actual secret values live in group_vars/all/vault.yml.
 
+ansible_user: "ansible"
+ansible_port: 25456
 
-# Hardening toggles (see roles/security)
-ssh_permit_root_login: "no"
-ssh_password_authentication: "no"
-ssh_port: 25456
 
 ufw_allowed_tcp_ports:
   - "{{ ssh_port }}"

group_vars/firstrun/main.yml

@@ -2,7 +2,8 @@
 # vars that are only used for the first setup. after this the defaults change to not use root.
 # this is to setup the ansible user, basic tools and security measures.
 
-# setup needed connection information
+# setup needed connection information, overrides the values in all group
+ansible_user: "root"
 ansible_port: 22
 
 # The non-root user created/used for all future Ansible runs
@@ -14,5 +15,5 @@ deploy_user_ssh_keys:
   - "{{ ssh_key_ansible }}"
 
 timezone: "America/Chicago"
-ufw_allowed_tcp_ports_extra :
+ufw_allowed_tcp_ports_extr:
   - 25456

group_vars/webservers.yml

@@ -7,3 +7,4 @@ nginx_sites:
 ufw_allowed_tcp_ports_extra:
   - 80
   - 443
+

roles/security/defaults/main.yml

@@ -1,2 +1,7 @@
 ---
 security_ufw_allowed_tcp_ports_extra: []
+
+#sshd config
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_port: 25456