---
- name: Verify
  hosts: all
  become: true
  tasks:
    - name: Gather service facts
      ansible.builtin.service_facts:

    - name: The sshd hardening drop-in is present
      ansible.builtin.stat:
        path: /etc/ssh/sshd_config.d/60-hardening.conf
      register: ssh_dropin

    - name: Read the effective sshd configuration
      ansible.builtin.command: sshd -T
      register: sshd_effective
      changed_when: false

    - name: SSH is hardened as expected
      ansible.builtin.assert:
        that:
          - ssh_dropin.stat.exists
          - "'permitrootlogin no' in sshd_effective.stdout"
          - "'passwordauthentication no' in sshd_effective.stdout"
        fail_msg: "sshd is not hardened as expected"

    - name: The admin user exists and is in the admin group
      ansible.builtin.command: id deploy
      register: id_deploy
      changed_when: false
      failed_when: "'admins' not in id_deploy.stdout"

    - name: sysctl hardening is live
      ansible.builtin.command: sysctl -n net.ipv4.tcp_syncookies
      register: syncookies
      changed_when: false
      failed_when: syncookies.stdout | trim != "1"

    - name: unattended-upgrades is installed and enabled
      ansible.builtin.assert:
        that:
          - "'unattended-upgrades.service' in ansible_facts.services"
        fail_msg: "unattended-upgrades is not present"

    - name: journald is set to persistent storage
      ansible.builtin.command: grep -R "Storage=persistent" /etc/systemd/journald.conf.d/
      register: journald_grep
      changed_when: false