---
- name: Set hostname
  ansible.builtin.hostname:
    name: "{{ common_hostname }}"
  tags: [common, hostname]

- name: Set timezone
  community.general.timezone:
    name: "{{ common_timezone }}"
  tags: [common, timezone]

- name: Update apt cache
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600
  tags: [common, packages]

- name: Install common packages
  ansible.builtin.apt:
    name: "{{ common_packages }}"
    state: present
  tags: [common, packages]

- name: Upgrade all packages
  ansible.builtin.apt:
    upgrade: safe
  tags: [common, packages, upgrade]
  when: apt_upgrade | default(false) | bool

- name: Configure SSH daemon
  ansible.builtin.template:
    src: sshd_config.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: "0644"
    validate: "sshd -t -f %s"
  notify: Restart sshd
  tags: [common, ssh]

- name: Ensure SSH is running
  ansible.builtin.systemd:
    name: sshd
    state: started
    enabled: true
  tags: [common, ssh]

- name: Configure UFW defaults
  community.general.ufw:
    direction: incoming
    policy: deny
  tags: [common, firewall]

- name: Allow SSH through UFW
  community.general.ufw:
    rule: allow
    port: "{{ sshd_port }}"
    proto: tcp
  tags: [common, firewall]

- name: Allow traffic from local network
  community.general.ufw:
    rule: allow
    src: 192.168.86.0/24
  tags: [common, firewall]

- name: Enable UFW
  community.general.ufw:
    state: enabled
  tags: [common, firewall]

- name: Configure fail2ban
  ansible.builtin.systemd:
    name: fail2ban
    state: started
    enabled: true
  tags: [common, security]

- name: Set vm.swappiness
  ansible.posix.sysctl:
    name: vm.swappiness
    value: "10"
    state: present
    reload: true
  tags: [common, sysctl]

- name: Configure NTP
  ansible.builtin.apt:
    name: chrony
    state: present
  tags: [common, ntp]

- name: Start chrony
  ansible.builtin.systemd:
    name: chrony
    state: started
    enabled: true
  tags: [common, ntp]