---
- name: Install baseline packages
  apt:
    name:
      - nftables
      - nginx
      - fail2ban
      - jq
      - curl
    state: present
    update_cache: true

- name: Ensure directories
  file:
    path: "{{ item }}"
    state: directory
    mode: "0755"
  loop:
    - /etc/nftables.d
    - /etc/edge
    - /var/www/letsencrypt

- name: Deploy nftables edge policy
  copy:
    src: "nftables/edge.nft"
    dest: "/etc/nftables.d/edge.nft"
    mode: "0644"

- name: Ensure nftables.conf includes /etc/nftables.d/*.nft
  lineinfile:
    path: /etc/nftables.conf
    line: 'include "/etc/nftables.d/*.nft"'
    create: true

- name: Enable and apply nftables
  systemd:
    name: nftables
    enabled: true
    state: restarted

- name: Deploy nginx site
  copy:
    src: "nginx/erplibre.conf"
    dest: "/etc/nginx/sites-available/erplibre.conf"
    mode: "0644"

- name: Enable nginx site
  file:
    src: /etc/nginx/sites-available/erplibre.conf
    dest: /etc/nginx/sites-enabled/erplibre.conf
    state: link
    force: true

- name: Remove default nginx site if present
  file:
    path: /etc/nginx/sites-enabled/default
    state: absent

- name: Test nginx configuration
  command: nginx -t
  changed_when: false

- name: Reload nginx
  systemd:
    name: nginx
    state: reloaded
    enabled: true

- name: Deploy fail2ban jail
  copy:
    src: "fail2ban/jail.local"
    dest: "/etc/fail2ban/jail.d/erplibre.local"
    mode: "0644"

- name: Deploy fail2ban filters
  copy:
    src: "fail2ban/filters/"
    dest: "/etc/fail2ban/filter.d/"
    mode: "0644"

- name: Restart fail2ban
  systemd:
    name: fail2ban
    state: restarted
    enabled: true

- name: Deploy ASN mitigation script and lists
  copy:
    src: "asn-mitigation/update-asn-ttl-blocklist.sh"
    dest: "/usr/local/sbin/update-asn-ttl-blocklist.sh"
    mode: "0750"

- name: Deploy ASN deny/allow lists (templates)
  copy:
    src: "asn-mitigation/{{ item }}"
    dest: "/etc/edge/{{ item }}"
    mode: "0644"
  loop:
    - asn-denylist.txt
    - asn-allowlist-v4.txt

- name: Deploy systemd units for ASN timer
  copy:
    src: "asn-mitigation/{{ item }}"
    dest: "/etc/systemd/system/{{ item }}"
    mode: "0644"
  loop:
    - asn-ttl-blocklist.service
    - asn-ttl-blocklist.timer

- name: systemd daemon-reload
  systemd:
    daemon_reload: true

- name: Enable ASN timer
  systemd:
    name: asn-ttl-blocklist.timer
    enabled: true
    state: started

- name: Deploy logrotate rule
  copy:
    src: "logrotate/nginx-erplibre"
    dest: "/etc/logrotate.d/nginx-erplibre"
    mode: "0644"