split SSH-related configs into separate role