ansible_role_ssh-keyonly/tasks/main.yml

---
- name: "Set «PermitRootLogin» to «without-password»"
  lineinfile:
    dest: /etc/ssh/sshd_config
    regexp: '^#? *PermitRootLogin'
    line: "PermitRootLogin without-password"
    backup: yes
  register: sshconfigchanged


- name: Restart sshd
  service:
    name: "{{ ssh_service_name }}"
    state: restarted
    sleep: 5
  when: sshconfigchanged is changed