- name: Bootstrap new Linux servers
  hosts: all
  become: yes

  tasks:

    - name: Install packages on Debian/Ubuntu
      apt:
        name:
          - vim
          - htop
          - nmap
          - curl
          - wget
          - iperf3
          - fail2ban
          - net-tools
          - lsof
          - unzip
          - zip
          - git
          - sudo
          - tree
          - traceroute
          - dnsutils
          - ca-certificates
          - python3
          - python3-pip
          - software-properties-common
          - rsync
          - apt-transport-https
          - sysstat
          - screen
          - mtr
        state: present
        update_cache: yes
      when: ansible_facts['os_family'] == "Debian"

    - name: Ensure EPEL repo is enabled (RHEL/CentOS/AlmaLinux)
      yum:
        name: epel-release
        state: present
      when: ansible_facts['os_family'] == "RedHat"

    - name: Install packages on RHEL/CentOS/AlmaLinux
      yum:
        name:
          - vim
          - htop
          - nmap
          - curl
          - mtr
          - wget
          - iperf3
          - fail2ban
          - net-tools
          - lsof
          - unzip
          - zip
          - git
          - sudo
          - tmux
          - tree
          - bash-completion
          - traceroute
          - bind-utils        # provides dig, nslookup
          - ca-certificates
          - python3
          - python3-pip
          - rsync
          - sysstat
          - screen
        state: present
        update_cache: yes
      when: ansible_facts['os_family'] == "RedHat"

    - name: Ensure root's .ssh directory exists
      file:
        path: /root/.ssh
        state: directory
        owner: root
        group: root
        mode: '0700'

    - name: Set authorized_keys for root
      copy:
        dest: /root/.ssh/authorized_keys
        content: |
          ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key
        owner: root
        group: root
        mode: '0600'

    - name: Permit root login via public key
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PermitRootLogin\s+'
        line: 'PermitRootLogin prohibit-password'
        state: present
        backup: yes

    - name: Ensure PubkeyAuthentication is enabled
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PubkeyAuthentication\s+'
        line: 'PubkeyAuthentication yes'
        state: present

    - name: Ensure PasswordAuthentication is enabled
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PasswordAuthentication\s+'
        line: 'PasswordAuthentication yes'
        state: present

    - name: Restart SSH service (Debian)
      service:
        name: ssh
        state: restarted
      when: ansible_facts['os_family'] == "Debian"

    - name: Restart SSH service (RHEL)
      service:
        name: sshd
        state: restarted
      when: ansible_facts['os_family'] == "RedHat"