---
# linux-baseline — apply a repeatable security baseline to a fresh Debian/Ubuntu host.
# Each section is toggleable so the role can be adopted incrementally.

- name: Assert the host is a supported distribution
  ansible.builtin.assert:
    that:
      - ansible_facts['os_family'] == 'Debian'
    fail_msg: >-
      linux-baseline supports Debian-family hosts only
      (detected os_family={{ ansible_facts['os_family'] }}).
      Scope was kept narrow on purpose — see the README.
    quiet: true

- name: Apply base packages
  ansible.builtin.import_tasks: packages.yml
  when: linux_baseline_manage_packages | bool
  tags: [packages]

- name: Manage admin users and SSH keys
  ansible.builtin.import_tasks: users.yml
  when: linux_baseline_manage_users | bool
  tags: [users]

- name: Harden the SSH daemon
  ansible.builtin.import_tasks: ssh.yml
  when: linux_baseline_manage_ssh | bool
  tags: [ssh]

- name: Apply kernel/network sysctl hardening
  ansible.builtin.import_tasks: sysctl.yml
  when: linux_baseline_manage_sysctl | bool
  tags: [sysctl]

- name: Enable automatic security updates
  ansible.builtin.import_tasks: updates.yml
  when: linux_baseline_manage_updates | bool
  tags: [updates]

- name: Configure persistent, size-capped journald
  ansible.builtin.import_tasks: journald.yml
  when: linux_baseline_manage_journald | bool
  tags: [journald]