From 642a0f8ea41eb11903d6159e58e6f78585a8ad3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Sun, 23 Aug 2026 23:27:15 +0200
Subject: [PATCH] fix(sshd): move login banner to zsh .zprofile

sshd Banner fires on every connection (scp, sftp, non-interactive), the wrong layer for a welcome banner. Move to .zprofile, interactive login shells only.
---
 roles/sshd/defaults/main.yml                              | 1 -
 roles/sshd/tasks/main.yml                                 | 8 --------
 roles/sshd/templates/sshd_config.j2                       | 3 ---
 roles/zsh/tasks/user-setup.yml                            | 8 ++++++++
 .../sshd_banner.j2 => zsh/templates/zprofile.j2}          | 7 +++++++
 5 files changed, 15 insertions(+), 12 deletions(-)
 rename roles/{sshd/templates/sshd_banner.j2 => zsh/templates/zprofile.j2} (95%)

diff --git a/roles/sshd/defaults/main.yml b/roles/sshd/defaults/main.yml
index 9854b2c..d4e07d1 100644
--- a/roles/sshd/defaults/main.yml
+++ b/roles/sshd/defaults/main.yml
@@ -6,7 +6,6 @@ ssh_allowed_networks:
 ssh_users: "jokester" # space separated if many
 ssh_config_dir: "/etc/ssh"
 sshd_config: "{{ ssh_config_dir }}/sshd_config"
-sshd_banner: "{{ ssh_config_dir }}/banner"
 sshd_binary: "/usr/sbin/sshd"
 ssh_authorized_keys_fallback_enabled: false
 ssh_authorized_keys_fallback_dir: "/etc/ssh/authorized_keys"
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index 2cc5ba8..caa8308 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -63,14 +63,6 @@
         mode: "0600"
       loop: "{{ ssh_users.split() }}"
 
-- name: Create an SSH banner
-  ansible.builtin.template:
-    src: templates/sshd_banner.j2
-    dest: "{{ sshd_banner }}"
-    owner: root
-    group: root
-    mode: "0644"
-
 - name: Remove motd on Debian
   ansible.builtin.file:
     path: /etc/motd
diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2
index b34257c..0b707e4 100644
--- a/roles/sshd/templates/sshd_config.j2
+++ b/roles/sshd/templates/sshd_config.j2
@@ -44,9 +44,6 @@ PermitUserEnvironment no
 SyslogFacility AUTH
 LogLevel VERBOSE
 
-# Banner
-Banner /etc/ssh/banner
-
 # SFTP
 Subsystem sftp internal-sftp
 
diff --git a/roles/zsh/tasks/user-setup.yml b/roles/zsh/tasks/user-setup.yml
index be35dba..005f341 100644
--- a/roles/zsh/tasks/user-setup.yml
+++ b/roles/zsh/tasks/user-setup.yml
@@ -7,6 +7,14 @@
     group: "{{ zsh_user }}"
     mode: "0600"
 
+- name: Setup .zprofile (login banner)
+  ansible.builtin.template:
+    src: zprofile.j2
+    dest: "{{ zsh_home }}/.zprofile"
+    owner: "{{ zsh_user }}"
+    group: "{{ zsh_user }}"
+    mode: "0600"
+
 - name: Setup zsh base config
   ansible.builtin.template:
     src: main.zshrc.j2
diff --git a/roles/sshd/templates/sshd_banner.j2 b/roles/zsh/templates/zprofile.j2
similarity index 95%
rename from roles/sshd/templates/sshd_banner.j2
rename to roles/zsh/templates/zprofile.j2
index ac7f3f7..29f8c50 100644
--- a/roles/sshd/templates/sshd_banner.j2
+++ b/roles/zsh/templates/zprofile.j2
@@ -1,3 +1,8 @@
+# {{ ansible_managed }}
+# Login banner - shown once per interactive login shell (before .zshrc / prompt)
+
+if [[ -o interactive ]]; then
+  cat <<'ANSIBLE_BANNER_END'
 {% if ansible_host == 'andromeda' %}
 *******************************************
  Beep beep-wooOOoo! Brrrp! Zzt zzt-whirl!
@@ -67,3 +72,5 @@ JEDI LOST - UNKNOWN STAR SYSTEM
 {% if ansible_hostname is defined %}
 {{ group_names | first }}: {{ ansible_hostname }}
 {% endif %}
+ANSIBLE_BANNER_END
+fi