# Alliance Boréale - Rôle Common
# Couche: C1 (Physique)
# Objectif: Hardening post-création VM
# Date: 2025-10-31

---
- name: "🔍 Gather facts"
  ansible.builtin.setup:
  tags: always

- name: "📦 Update apt cache"
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600
  tags: packages

- name: "📦 Install base packages"
  ansible.builtin.apt:
    name: "{{ base_packages }}"
    state: present
  tags: packages

- name: "🕐 Configure timezone"
  community.general.timezone:
    name: "{{ system.timezone }}"
  tags: system

- name: "🕐 Configure NTP (chrony)"
  ansible.builtin.import_tasks: ntp.yml
  when: ntp.enabled | default(true)
  tags: ntp

- name: "👤 Create ansible user"
  ansible.builtin.user:
    name: "{{ users.ansible.name }}"
    groups: "{{ users.ansible.groups }}"
    shell: "{{ users.ansible.shell }}"
    create_home: true
    state: present
  tags: users

- name: "👤 Configure sudo for ansible user"
  ansible.builtin.lineinfile:
    path: /etc/sudoers.d/ansible
    line: "{{ users.ansible.name }} ALL=(ALL) NOPASSWD:ALL"
    create: true
    mode: '0440'
    validate: 'visudo -cf %s'
  when: users.ansible.sudo_nopasswd | default(true)
  tags: users

- name: "🔐 Configure SSH"
  ansible.builtin.import_tasks: ssh.yml
  tags: ssh

- name: "🔥 Configure firewall (nftables)"
  ansible.builtin.import_tasks: nftables.yml
  when: security.firewall == 'nftables'
  tags: firewall

- name: "📊 Configure logging"
  ansible.builtin.import_tasks: logging.yml
  tags: logging

- name: "🔒 Security hardening"
  ansible.builtin.import_tasks: security.yml
  tags: security

- name: "✅ Common role completed"
  ansible.builtin.debug:
    msg: "✅ VM {{ inventory_hostname }} hardened successfully"
  tags: always