Normalize conditions and check Match User statement better

No need for two facts if one invalidates the other.

evolinux-users/tasks/ssh.yml

@@ -29,23 +29,16 @@
 - set_fact:
     # If "AllowGroups is present" or "AllowUsers is absent and Debian 10+",
     ssh_allowgroups: "{{ (grep_allowgroups_ssh.rc == 0) or (grep_allowusers_ssh.rc != 0 and (ansible_distribution_major_version | version_compare('10', '>='))) }}"
-    # If "AllowGroups is absent" and "AllowUsers is absent or Debian <10"
-    ssh_allowusers:  "{{ (grep_allowusers_ssh.rc == 0) or (grep_allowgroups_ssh.rc != 0 and (ansible_distribution_major_version | version_compare('10', '<'))) }}"
 
 - debug:
     var: ssh_allowgroups
     verbosity: 1
 
-- debug:
-    var: ssh_allowusers
-    verbosity: 1
-
 - include: ssh_allowgroups.yml
   vars:
     - allow_groups_present: "{{ grep_allowgroups_ssh.rc == 0 }}"
   when:
     - ssh_allowgroups
-    - not ssh_allowusers
 
 - name: "Add AllowUsers sshd directive with all users"
   lineinfile:
@@ -56,7 +49,6 @@
   notify: reload sshd
   when:
     - grep_allowusers_ssh.rc != 0
-    - ssh_allowusers
     - not ssh_allowgroups
 
 - name: "Append '{{ item.name }}' to AllowUsers sshd directive"
@@ -67,7 +59,9 @@
     validate: '/usr/sbin/sshd -t -f %s'
   with_dict: "{{ evolinux_users }}"
   notify: reload sshd
-  when: grep_allowusers_ssh.rc == 0
+  when:
+    - grep_allowusers_ssh.rc == 0
+    - not ssh_allowgroups
 
 - name: "verify Match User directive"
   command: "grep -E '^Match User' /etc/ssh/sshd_config"
@@ -75,9 +69,7 @@
   failed_when: False
   check_mode: no
   register: grep_matchuser_ssh
-  when:
-    - ssh_allowusers
-    - not ssh_allowgroups
+  when: not ssh_allowgroups
 
 - name: "Add Match User sshd directive with all users"
   lineinfile:
@@ -86,7 +78,9 @@
     insertafter: "# END EVOLINUX PASSWORD RESTRICTIONS BY ADDRESS"
     validate: '/usr/sbin/sshd -t -f %s'
   notify: reload sshd
-  when: grep_matchuser_ssh != 0
+  when:
+    - grep_matchuser_ssh != 0
+    - not ssh_allowgroups
 
 - name: "Append '{{ item.name }}' to Match User's sshd directive"
   replace:
@@ -96,7 +90,9 @@
     validate: '/usr/sbin/sshd -t -f %s'
   with_dict: "{{ evolinux_users }}"
   notify: reload sshd
-  when: grep_matchuser_ssh.rc == 0
+  when:
+    - grep_matchuser_ssh.rc == 0
+    - not ssh_allowgroups
 
 - name: disable root login
   replace: