---
- name: Show host IP
  ansible.builtin.debug:
    msg: "{{ ansible_facts['default_ipv4'] }}"


# --- Users & group ---

- name: Add group matzman
  ansible.builtin.group:
    name: matzman
    state: present
    gid: 1000

- name: Add user matzman
  ansible.builtin.user:
    name: matzman
    uid: 1000
    group: matzman
    create_home: yes


# --- Install required packages ---

- name: Update apt cache
  ansible.builtin.apt:
    update_cache: yes
  become: true

- name: Upgrade all packages
  ansible.builtin.apt:
    upgrade: dist
    update_cache: yes

- name: Check if reboot is required
  ansible.builtin.stat:
    path: /var/run/reboot-required
  register: reboot_required

- name: Reboot if required
  ansible.builtin.reboot:
    reboot_timeout: 300
  when: reboot_required.stat.exists

- name: Install custom packages
  ansible.builtin.package:
    name:
        # Required by an ansible task later
        - python3-requests
    state: present


# --- Unattended upgrades ---

- name: Install unattended-upgrades
  ansible.builtin.package:
    name:
      - unattended-upgrades
      - apt-listchanges
    state: present

- name: Enable automatic security upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
    mode: "0644"


# --- SSH setup ---

- name: Set authorized key for matzman
  ansible.posix.authorized_key:
    user: matzman
    state: present
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBi8TS/s2X7W7gb+rGm7A2PG9hRDLa3kYdNM9hLNY0w matzman+2025@matzman.net"

- name: Set authorized key for root
  ansible.posix.authorized_key:
    user: root
    state: present
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBi8TS/s2X7W7gb+rGm7A2PG9hRDLa3kYdNM9hLNY0w matzman+2025@matzman.net"


# --- SSH hardening ---

- name: Disable SSH password authentication
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?PasswordAuthentication'
    line: 'PasswordAuthentication no'
  notify: Restart SSH

#- name: Disable SSH root login
#  ansible.builtin.lineinfile:
#    path: /etc/ssh/sshd_config
#    regexp: '^#?PermitRootLogin'
#    line: 'PermitRootLogin no'
#  notify: Restart SSH

# --- fail2ban ---

- name: Install fail2ban
  ansible.builtin.package:
    name: fail2ban
    state: present

- name: Enable and start fail2ban
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: yes


# --- Wireguard ---

- name: Install wireguard packages
  ansible.builtin.package:
    name:
        - wireguard-tools
    state: present

- name: Ensure /etc/wireguard directory exists
  ansible.builtin.file:
    path: /etc/wireguard
    state: directory
    owner: root
    group: root
    mode: "0700"
  tags: wireguard

- name: "Deploy {{ wg_if }} config"
  ansible.builtin.template:
    src: "{{ wg_if }}.conf.j2"
    dest: "/etc/wireguard/{{ wg_if }}.conf"
    owner: root
    group: root
    mode: "0600"
  notify: Restart wg0
  tags: wireguard

- name: "Enable and start wg-quick@{{ wg_if }}"
  ansible.builtin.systemd:
    name: "wg-quick@{{ wg_if }}"
    enabled: yes
    state: started
  tags: wireguard


# --- Firewall ---

- name: Install iptables-persistent
  ansible.builtin.package:
    name:
      - iptables-persistent
      - netfilter-persistent
    state: present

- name: Deploy iptables rules (IPv4)
  ansible.builtin.template:
    src: rules.v4.j2
    dest: /etc/iptables/rules.v4
    mode: "0640"
  notify:
    - Reload iptables
    - Restart Docker

- name: Deploy iptables rules (IPv6)
  ansible.builtin.template:
    src: rules.v6.j2
    dest: /etc/iptables/rules.v6
    mode: "0640"
  notify:
    - Reload ip6tables
    - Restart Docker

# --- sysctl hardening ---

- name: Configure sysctl security settings
  ansible.posix.sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: present
    reload: yes
  loop:
    - { name: 'net.ipv4.conf.all.rp_filter',            value: '1' }
    - { name: 'net.ipv4.conf.default.rp_filter',        value: '1' }
    - { name: 'net.ipv4.conf.all.accept_redirects',     value: '0' }
    - { name: 'net.ipv4.conf.default.accept_redirects', value: '0' }
    - { name: 'net.ipv4.conf.all.send_redirects',       value: '0' }
    - { name: 'net.ipv4.conf.default.send_redirects',   value: '0' }


# --- Audit logging ---

- name: Install auditd
  ansible.builtin.package:
    name: auditd
    state: present

- name: Enable and start auditd
  ansible.builtin.service:
    name: auditd
    state: started
    enabled: yes