---
- name: Bootstrap - Install packages on Ubuntu
  hosts: ubuntu
  become: true

  tasks:
    - name: Install packages via apt
      ansible.builtin.apt:
        name:
          - vim
          - htop
          - nmap
          - curl
          - wget
          - iperf3
          - fail2ban
          - net-tools
          - lsof
          - unzip
          - zip
          - git
          - sudo
          - tree
          - traceroute
          - dnsutils
          - ca-certificates
          - python3
          - python3-pip
          - software-properties-common
          - rsync
          - apt-transport-https
          - sysstat
          - screen
          - mtr
          - tar
        state: present
        update_cache: true

- name: Bootstrap - Install packages on Rocky Linux
  hosts: rocky
  become: true

  tasks:
    - name: Ensure EPEL repo is enabled
      ansible.builtin.dnf:
        name: epel-release
        state: present

    - name: Install packages via dnf
      ansible.builtin.dnf:
        name:
          - tar
          - vim
          - htop
          - nmap
          - curl
          - mtr
          - wget
          - iperf3
          - fail2ban
          - net-tools
          - lsof
          - unzip
          - zip
          - git
          - sudo
          - tmux
          - tree
          - bash-completion
          - traceroute
          - bind-utils
          - ca-certificates
          - python3
          - python3-pip
          - rsync
          - sysstat
          - screen
        state: present
        update_cache: true

- name: Bootstrap - Configure SSH access
  hosts: ubuntu:rocky
  become: true

  tasks:
    - name: Ensure root's .ssh directory exists
      ansible.builtin.file:
        path: /root/.ssh
        state: directory
        owner: root
        group: root
        mode: '0700'

    - name: Set authorized_keys for root
      ansible.builtin.copy:
        dest: /root/.ssh/authorized_keys
        content: |
          ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key
        owner: root
        group: root
        mode: '0600'

    - name: Permit root login via public key
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PermitRootLogin\s+'
        line: 'PermitRootLogin prohibit-password'
        state: present
        backup: true

    - name: Ensure PubkeyAuthentication is enabled
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PubkeyAuthentication\s+'
        line: 'PubkeyAuthentication yes'
        state: present

    # NOTE: playbooks/ssh_harden.yml overrides this via /etc/ssh/sshd_config.d/00-ansible.conf
    - name: Ensure PasswordAuthentication is enabled
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PasswordAuthentication\s+'
        line: 'PasswordAuthentication yes'
        state: present

- name: Bootstrap - Restart SSH on Ubuntu
  hosts: ubuntu
  become: true

  tasks:
    - name: Restart ssh service
      ansible.builtin.service:
        name: ssh
        state: restarted

- name: Bootstrap - Restart SSH on Rocky Linux
  hosts: rocky
  become: true

  tasks:
    - name: Restart sshd service
      ansible.builtin.service:
        name: sshd
        state: restarted