---

# apt cache
- name: update apt cache
  ansible.builtin.apt:
    update_cache: yes
    cache_valid_time: 3600

# SSH
- name: Copy sshd_config
  copy:
    src: ../templates/sshd_config
    dest: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: u=rw,g=r,o=r

- name: restart sshd
  service: name=sshd state=restarted enabled=yes

# FIREWALL
- name: install UFW
  apt: name=ufw state=latest

- name: allow ssh from everywhere and enable
  ufw:
    rule: allow
    name: OpenSSH
    state: enabled

- name: restart ufw
  service: name=ufw state=restarted enabled=yes

# FAIL2BAN
- name: install fail2ban
  apt: name=fail2ban state=latest

- name: Copy jail.conf
  copy:
    src: ../templates/jail.conf
    dest: /etc/fail2ban/jail.conf
    owner: root
    group: root
    mode: u=rw,g=r,o=r

- name: restart fail2ban
  service: name=fail2ban state=restarted enabled=yes

# DNS
- name: install systemd-resolved
  apt: name=systemd-resolved state=latest

- name: Check if systemd-resolved config exists
  ansible.builtin.stat:
    path: /etc/systemd/resolved.conf
  register: systemd_resolved_config
  check_mode: false

- name: Update DNS servers for systemd-resolvd
  ansible.builtin.include_tasks:
    file: 'systemd-resolved.yml'
  when: systemd_resolved_config.stat.exists | bool

- name: Check if systemd-resolved runs
  ansible.builtin.shell: pgrep systemd-resolve
  failed_when: false
  changed_when: false
  register: systemd_resolved_running
  check_mode: false