Public key auth, and fail2ban on an extremely strict mode with scaling bantime works well enough for me to leave 22 open.

Fail2ban will ban people for even checking if the port is open.

Ansible vault

How is that going to even work, technically?

I think you should try it out just to see what happens. Worst case it doesn’t work, and if it does work there’s a good chance you’ll uncover some bugs that need fixing.