5 files changed, 22 insertions, 6 deletions
diff --git a/roles/core/base/tasks/Debian.yml b/roles/core/base/tasks/Debian.yml
index 4d2abc17..43f1876e 100644
--- a/roles/core/base/tasks/Debian.yml
+++ b/roles/core/base/tasks/Debian.yml
@@ -156,6 +156,15 @@
     state: "{{ base_enable_fstrim | ternary('started', 'stopped') }}"
     enabled: "{{ base_enable_fstrim }}"
 
+- name: configure timezone
+  timezone:
+    name: "{{ base_timezone }}"
+  register: etc_localtime
+
+- name: make sure legacy /etc/timezone is in sync with /etc/localtime
+  when: etc_localtime is changed
+  command: dpkg-reconfigure -f noninteractive tzdata
+
 - name: remove cloud-init bullshit
   loop:
   - /var/log/cloud-init.log
diff --git a/roles/core/base/tasks/OpenBSD.yml b/roles/core/base/tasks/OpenBSD.yml
index fbc06379..7ff4f324 100644
--- a/roles/core/base/tasks/OpenBSD.yml
+++ b/roles/core/base/tasks/OpenBSD.yml
@@ -13,3 +13,7 @@
   openbsd_pkg:
     name: "{{ base_packages_extra }}"
     state: present
+
+- name: configure timezone
+  timezone:
+    name: "{{ base_timezone }}"
diff --git a/roles/core/base/tasks/main.yml b/roles/core/base/tasks/main.yml
index fe4a396c..a70bc7ad 100644
--- a/roles/core/base/tasks/main.yml
+++ b/roles/core/base/tasks/main.yml
@@ -34,7 +34,3 @@
   copy:
     src: "{{ global_files_dir }}/common/htoprc"
     dest: "{{ item }}/.config/htop/"
-
-- name: configure timezone
-  timezone:
-    name: "{{ base_timezone }}"
diff --git a/roles/core/sshd/jump/defaults/main.yml b/roles/core/sshd/jump/defaults/main.yml
index ada0554a..63546eaa 100644
--- a/roles/core/sshd/jump/defaults/main.yml
+++ b/roles/core/sshd/jump/defaults/main.yml
@@ -6,3 +6,10 @@
 #     - ssh-rsa ...
 #     permit_open:
 #     - host:port
+#   foo:
+#     authorized_keys:
+#     - ssh-ed25519 ....
+#     - ssh-rsa ...
+#     tcp_forwarding: remote
+#     permit_listen:
+#     - 22001
diff --git a/roles/core/sshd/jump/tasks/main.yml b/roles/core/sshd/jump/tasks/main.yml
index 2120cbd6..59cb4f66 100644
--- a/roles/core/sshd/jump/tasks/main.yml
+++ b/roles/core/sshd/jump/tasks/main.yml
@@ -49,9 +49,9 @@
         AllowAgentForwarding no
         AllowStreamLocalForwarding no
         ForceCommand /sbin/nologin
-        AllowTcpForwarding local
+        AllowTcpForwarding {{ config.tcp_forwarding | default('local') }}
         PermitOpen {{ config.permit_open | default(['any']) | list | join(' ') }}
-        PermitListen none
+        PermitListen {{ config.permit_listen | default(['none']) | list | join(' ') }}
       {%   if not loop.last %}
 
       {%   endif %}