# Alliance Boréale - Rôle Common - Security Hardening
# Date: 2025-10-31

---
- name: "🔒 Disable unnecessary services"
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: stopped
    enabled: false
  loop:
    - bluetooth
    - cups
  failed_when: false

- name: "🔒 Configure sysctl security parameters"
  ansible.posix.sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
    state: present
    reload: true
  loop:
    - { key: 'net.ipv4.conf.all.rp_filter', value: '1' }
    - { key: 'net.ipv4.conf.default.rp_filter', value: '1' }
    - { key: 'net.ipv4.icmp_echo_ignore_broadcasts', value: '1' }
    - { key: 'net.ipv4.conf.all.accept_source_route', value: '0' }
    - { key: 'net.ipv4.conf.default.accept_source_route', value: '0' }
    - { key: 'net.ipv4.conf.all.send_redirects', value: '0' }
    - { key: 'net.ipv4.conf.default.send_redirects', value: '0' }
    - { key: 'net.ipv4.tcp_syncookies', value: '1' }
    - { key: 'net.ipv4.conf.all.log_martians', value: '1' }
    - { key: 'kernel.randomize_va_space', value: '2' }

- name: "🔒 Install fail2ban"
  ansible.builtin.apt:
    name: fail2ban
    state: present
  when: security.fail2ban_enabled | default(true)

- name: "🔒 Configure fail2ban"
  ansible.builtin.copy:
    dest: /etc/fail2ban/jail.local
    content: |
      [DEFAULT]
      bantime = 3600
      findtime = 600
      maxretry = 5
      
      [sshd]
      enabled = true
    owner: root
    group: root
    mode: '0644'
  when: security.fail2ban_enabled | default(true)
  notify: restart fail2ban

- name: "🔒 Enable unattended upgrades"
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present
  when: security.unattended_upgrades | default(true)

- name: "🔒 Configure automatic security updates"
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/50unattended-upgrades
    content: |
      Unattended-Upgrade::Allowed-Origins {
          "${distro_id}:${distro_codename}-security";
      };
      Unattended-Upgrade::AutoFixInterruptedDpkg "true";
      Unattended-Upgrade::MinimalSteps "true";
      Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
      Unattended-Upgrade::Remove-Unused-Dependencies "true";
      Unattended-Upgrade::Automatic-Reboot "false";
    owner: root
    group: root
    mode: '0644'
  when: security.unattended_upgrades | default(true)