---
- name: Deploy hardened sysctl configuration
  ansible.builtin.template:
    src: sysctl.conf.j2
    dest: /etc/sysctl.d/99-hardening.conf
    owner: root
    group: root
    mode: "0644"
  notify: Reload sysctl
  when: security_sysctl_hardening
  tags: [security, sysctl]

- name: Install auditd
  ansible.builtin.apt:
    name:
      - auditd
      - audispd-plugins
    state: present
  when: security_audit_enabled
  tags: [security, audit]

- name: Deploy audit rules
  ansible.builtin.template:
    src: audit.rules.j2
    dest: /etc/audit/rules.d/hardening.rules
    owner: root
    group: root
    mode: "0640"
  notify: Restart auditd
  when: security_audit_enabled
  tags: [security, audit]

- name: Enable unattended upgrades
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present
  when: security_auto_updates
  tags: [security, updates]

- name: Configure unattended upgrades
  ansible.builtin.copy:
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
      APT::Periodic::AutocleanInterval "7";
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    owner: root
    group: root
    mode: "0644"
  when: security_auto_updates
  tags: [security, updates]

- name: Disable core dumps
  ansible.posix.sysctl:
    name: fs.suid_dumpable
    value: "0"
    state: present
    reload: true
  tags: [security]

- name: Set secure permissions on cron directories
  ansible.builtin.file:
    path: "{{ item }}"
    owner: root
    group: root
    mode: "0700"
  loop:
    - /etc/cron.d
    - /etc/cron.daily
    - /etc/cron.hourly
    - /etc/cron.weekly
    - /etc/cron.monthly
  tags: [security]