Fix fail2ban and disable SSH password logins

fs.nr_open = 65536 sat below systemd's default hard NOFILE limit
(524288), so any service without its own LimitNOFILE failed to restart
once the sysctl was applied (205/LIMITS); fail2ban was down after the
last deploy, and after a reboot ssh could be too. Leave nr_open at the
kernel default.

fail2ban also read /var/log/auth.log, which Debian 13 no longer
writes; read sshd's journal instead.

Disable password and keyboard-interactive SSH logins and allow root
with keys only. The drop-in is named 10-* so it wins over cloud-init's
50-cloud-init.conf, which turns password logins on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/ansible/roles/base/handlers/main.yml

@@ -7,3 +7,8 @@
 - name: Reload sysctl
   ansible.builtin.command: sysctl --system
   changed_when: true
+
+- name: Reload ssh
+  ansible.builtin.systemd:
+    name: ssh
+    state: reloaded

deploy/ansible/roles/base/tasks/main.yml

@@ -68,6 +68,25 @@
     enabled: true
     state: started
 
+# --- SSH Hardening ---
+
+# Key-only logins. Named 10-* so sshd reads it before cloud-init's
+# 50-cloud-init.conf, which turns password logins on; sshd keeps the first
+# value it sees for each option. The Vultr web console still accepts the
+# root password if the key is ever lost.
+- name: Disable SSH password authentication
+  ansible.builtin.copy:
+    dest: /etc/ssh/sshd_config.d/10-rustyip.conf
+    content: |
+      PasswordAuthentication no
+      KbdInteractiveAuthentication no
+      PermitRootLogin prohibit-password
+    owner: root
+    group: root
+    mode: "0644"
+    validate: /usr/sbin/sshd -t -f %s
+  notify: Reload ssh
+
 # --- Kernel Tuning ---
 
 - name: Deploy sysctl tuning configuration

deploy/ansible/roles/base/templates/fail2ban-sshd.conf.j2

@@ -10,5 +10,5 @@ bantime   = 3600
 banaction         = iptables-multiport
 banaction_allports = iptables-allports
 
-logpath   = /var/log/auth.log
-backend   = auto
+# Debian 13 logs to the journal only (no rsyslog, so no /var/log/auth.log)
+backend   = systemd

deploy/ansible/roles/base/templates/sysctl.conf.j2

@@ -48,7 +48,9 @@ net.ipv4.tcp_max_tw_buckets = 65536
 
 # File descriptor limits (reduced for 1 GB RAM)
 fs.file-max = 65536
-fs.nr_open = 65536
+# fs.nr_open stays at the kernel default: systemd gives services a hard
+# NOFILE limit of 524288, and lowering nr_open below that makes every
+# service without its own LimitNOFILE fail to (re)start (205/LIMITS).
 
 # VM tuning (increased swappiness slightly for 1 GB RAM)
 vm.swappiness = 30