To drop all internet traffic that is new iptables -A INPUT -i eth0 -s 0.0.0.0/0 -m conntrack --ctstate NEW -j DROP
To allow only your ip on tcp/22 iptables -A INPUT -i eth0 -s a.b.c.d/32 -m conntrack --ctstate NEW -j ACCEPT
Use -u to supply username and --ask-pass to be prompted to password. Before an authorized key is setup on the destination server.
Can bootstrap a authorized key using ansible.posix.authorized_key supplying root or whoever as the user and a lookup to the source pub key file
For some reason passing SSH options within a play task doesn't seem to be working for you if you are using an AWX Execution Environment. From what I've found Execution Environments don't actually respect additional SSH options being passed via task. If you want to use different options you will need to make sure you Execution Environment has the needed SSH options available within the SSH config, if it doesn't and you need newer or older crypto options build a new Execution Environment with a RUN update-crypto-policies --set <LEGACY|FUTURE> . This issue cost me about a full day of work.
The official Python packaging tutorial has you naming your package with underscores, within PEP 8 though this is actively discouraged. https://peps.python.org/pep-0008/#package-and-module-names. If using pip to install, it will take these and then translate them to hyphens, but hyphens are seen as invalid syntax when performing an import. It's just easier to not use a folder structure that is accurate with short lowercase names for each folder, the modules themselves (.py files) may then have underscores if needed to be descriptive.