---
# Example: apply the baseline to a group of servers.
#
# Run with:
#   ansible-galaxy collection install -r requirements.yml
#   ansible-playbook -i inventory.ini examples/playbook.yml
#
# The values below are illustrative. Put real users and keys in your own
# inventory or a vault-encrypted vars file — never commit private data.

- name: Apply the security baseline
  hosts: servers
  become: true
  vars:
    linux_baseline_admin_users:
      - name: alice
        authorized_keys:
          - "ssh-ed25519 AAAAC3Nz...replace-with-a-real-public-key alice@laptop"
      - name: bob
        shell: /bin/bash
        authorized_keys:
          - "ssh-ed25519 AAAAC3Nz...replace-with-a-real-public-key bob@laptop"

    # Turn on auto-reboot inside a maintenance window once you trust the fleet.
    linux_baseline_unattended_automatic_reboot: true
    linux_baseline_unattended_automatic_reboot_time: "04:00"

  roles:
    - role: ansible-linux-baseline