---
# revert-ssh.yml
#
# Reverts the SSH IP-range restriction applied by restrict-ssh.yml.
# Removes the range-limited SSH rule and re-opens SSH from anywhere so
# you don't lose access. Optionally disables UFW entirely.
#
# Uses the community.general.ufw module.
#
# Usage:
#   ansible-playbook -i inventory.ini revert-ssh.yml
#
# To also disable UFW completely:
#   ansible-playbook -i inventory.ini revert-ssh.yml -e "disable_ufw=true"
#
# Override the range or port to match what restrict-ssh.yml used:
#   ansible-playbook -i inventory.ini revert-ssh.yml -e "ssh_allowed_range=10.0.0.0/24 ssh_port=2222"

- name: Revert SSH IP-range restriction
  hosts: ubuntu_servers
  become: true

  vars:
    ssh_allowed_range: "192.168.1.0/24"
    ssh_port: 22
    disable_ufw: false

  tasks:
    - name: Remove the range-restricted SSH rule
      community.general.ufw:
        rule: allow
        from_ip: "{{ ssh_allowed_range }}"
        to_port: "{{ ssh_port }}"
        proto: tcp
        delete: true

    - name: Re-open SSH from anywhere
      community.general.ufw:
        rule: allow
        to_port: "{{ ssh_port }}"
        proto: tcp
      when: not disable_ufw | bool

    - name: Disable UFW entirely (optional)
      community.general.ufw:
        state: disabled
      when: disable_ufw | bool