---
- name: Gate
  ansible.builtin.meta: end_host
  when: not hardening_common_enabled | bool

- name: Appliquer le socle sysctl
  ansible.posix.sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
    state: present
    sysctl_set: true
    reload: true
  loop: "{{ hardening_common_sysctl | dict2items }}"

- name: Déployer le drop-in SSH durci
  ansible.builtin.template:
    src: sshd_boreale_hardening.conf.j2
    dest: /etc/ssh/sshd_config.d/99-boreale-hardening.conf
    mode: '0644'
    validate: '/usr/sbin/sshd -T -f %s'
  notify: Reload ssh

- name: Créer le répertoire des drop-ins journald
  ansible.builtin.file:
    path: /etc/systemd/journald.conf.d
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Déployer le drop-in journald
  ansible.builtin.template:
    src: journald-boreale.conf.j2
    dest: /etc/systemd/journald.conf.d/99-boreale.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart journald

- name: Installer fail2ban
  ansible.builtin.apt:
    name: fail2ban
    state: present
  when: hardening_common_fail2ban_enabled | bool

- name: Déployer la jail sshd fail2ban
  ansible.builtin.template:
    src: jail-sshd.local.j2
    dest: /etc/fail2ban/jail.d/sshd.local
    mode: '0644'
  when:
    - hardening_common_fail2ban_enabled | bool
    - hardening_common_fail2ban_sshd_enabled | bool
  notify: Restart fail2ban

- name: Activer fail2ban
  ansible.builtin.systemd:
    name: fail2ban
    enabled: true
    state: started
  when: hardening_common_fail2ban_enabled | bool

- name: Déployer unattended-upgrades auto
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    mode: '0644'
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
      APT::Periodic::AutocleanInterval "7";
  when: hardening_common_unattended_upgrades_enabled | bool

- name: Déployer unattended-upgrades de base
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
    mode: '0644'
    content: |
      Unattended-Upgrade::Remove-Unused-Dependencies "true";
      Unattended-Upgrade::Automatic-Reboot "false";
      Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
  when: hardening_common_unattended_upgrades_enabled | bool

- name: Installer debsecan
  ansible.builtin.apt:
    name: debsecan
    state: present
  when: hardening_common_debsecan_enabled | bool

- name: Activer AppArmor
  ansible.builtin.systemd:
    name: apparmor
    enabled: true
    state: started
  failed_when: false
  when: hardening_common_apparmor_enabled | bool