chore: archive fix for ssh_port deriving from ansible_port

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

openspec/changes/archive/2026-04-22-fix-ssh-port-default/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-04-22

openspec/changes/archive/2026-04-22-fix-ssh-port-default/design.md

@@ -0,0 +1,15 @@
+## Context
+
+Inventory defines `ansible_port: 21212` per host. `group_vars/all.yml` was supposed to derive `ssh_port` from `ansible_port` (matching the `.example` template), but was hardcoded to `22` instead. This means the sshd config, UFW rules, and fail2ban jail all use port 22 regardless of the actual SSH port.
+
+## Goals / Non-Goals
+
+**Goals:**
+- Make `ssh_port` automatically follow `ansible_port` from inventory
+
+**Non-Goals:**
+- No other changes
+
+## Decisions
+
+Change `ssh_port: 22` to `ssh_port: "{{ ansible_port | default(22) }}"` in `group_vars/all.yml`. This matches the `.example` and ensures per-host `ansible_port` is respected. The `default(22)` fallback handles the case where `ansible_port` is not defined.

openspec/changes/archive/2026-04-22-fix-ssh-port-default/proposal.md

@@ -0,0 +1,19 @@
+## Why
+
+`group_vars/all.yml` has `ssh_port: 22` hardcoded, while the `.example` template correctly uses `ssh_port: "{{ ansible_port | default(22) }}"`. This causes the SSH port in generated configs to always be 22, ignoring the `ansible_port` defined per-host in the inventory (e.g., `ansible_port: 21212`).
+
+## What Changes
+
+- Change `ssh_port` in `group_vars/all.yml` from hardcoded `22` to `{{ ansible_port | default(22) }}`
+
+## Capabilities
+
+### New Capabilities
+<!-- none -->
+
+### Modified Capabilities
+<!-- none -->
+
+## Impact
+
+- `group_vars/all.yml`: single line change

openspec/changes/archive/2026-04-22-fix-ssh-port-default/specs/NOTE.md

@@ -0,0 +1,3 @@
+## Note
+
+No capability changes. Internal variable precedence fix.

openspec/changes/archive/2026-04-22-fix-ssh-port-default/tasks.md

@@ -0,0 +1,3 @@
+## 1. Fix ssh_port default
+
+- [x] 1.1 Change `ssh_port: 22` to `ssh_port: "{{ ansible_port | default(22) }}"` in `group_vars/all.yml`