- hosts: all
  gather_facts: yes
  become: yes
  tasks:

################## Configure SSH and Security Settings ##################

    - name: Ensure the SSH configuration file has the correct permissions
      file:
        path: /etc/ssh/sshd_config
        owner: root
        group: root
        mode: '0600'

    - name: Backup the original SSH configuration file
      copy:
        src: /etc/ssh/sshd_config
        dest: /etc/ssh/sshd_config.bak
        owner: root
        group: root
        mode: '0600'

    - name: Remove PermitRootLogin prohibit-password
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "(?i)^(?!#).*PermitRootLogin.*prohibit-password"
        state: absent

    - name: Remove PasswordAuthentication yes
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "(?i)^(?!#).*PermitRootLogin.*yes"
        state: absent

    - name: Remove PermitEmptyPasswords no
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "(?i)^(?!#).*PermitEmptyPasswords.*no"
        state: absent

    - name: Configure sshd
      lineinfile:
        path: /etc/ssh/sshd_config
        regex: "^(#)?{{ item.key }}"
        line: "{{ item.key }} {{ item.value }}"
        state: present
      loop:
        - { key: "PermitRootLogin", value: "no" }
        - { key: "PasswordAuthentication", value: "no" }
        - { key: "PermitEmptyPasswords", value: "no" }
        - { key: "AllowUsers", value: "miker" }

    - name: restart sshd
      ansible.builtin.systemd:
        name: sshd
        state: restarted

    - name: Setup passwordless sudo
      lineinfile:
        path: /etc/sudoers
        state: present
        regexp: '^%sudo'
        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
        validate: '/usr/sbin/visudo -cf %s' 

################## Update and Upgrade System Packages ##################

    - name: Update apt repo and cache on all Debian/Ubuntu boxes
      apt: update_cache=yes force_apt_get=yes cache_valid_time=3600

    - name: Upgrade all packages on servers
      apt: upgrade=dist force_apt_get=yes

    - name: automatically remove unused dependencies
      lineinfile: dest=/etc/apt/apt.conf.d/50unattended-upgrades
                  regexp="Unattended-Upgrade::Remove-Unused-Dependencies"
                  line="Unattended-Upgrade::Remove-Unused-Dependencies \"true\";"
                  state=present
                  create=yes

    - name: echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections  - auto install security updates
      debconf: 
        name: unattended-upgrades 
        question: unattended-upgrades/enable_auto_updates 
        vtype: boolean 
        value: 'true'

    - name: apt install unattended-upgrades
      apt: 
        name: unattended-upgrades
     
    - name: dpkg-reconfigure -f noninteractive unattended-upgrades
      command:
        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
        creates: /etc/apt/apt.conf.d/20auto-upgrades

    - name: Check if a reboot is needed on all servers
      register: reboot_required_file
      stat: path=/var/run/reboot-required get_checksum=false

################### Install Required System Packages ##################

    - name: Update apt and install required system packages
      apt:
        pkg:
          - curl
          - wget
          - git
          - unattended-upgrades
          - qemu-guest-agent
        state: latest
        update_cache: true

    - name: Install fail2ban
      apt:
        name: fail2ban
        state: latest
        update_cache: true

    - name: set up fail2ban
      command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
               creates=/etc/fail2ban/jail.local
  
  ################# Reboot if Kernel Updated ##################
  
    - name: Reboot the box if kernel updated
      reboot:
        msg: "Reboot initiated by Ansible for kernel updates"
        connect_timeout: 5
        reboot_timeout: 300
        pre_reboot_delay: 0
        post_reboot_delay: 30
        test_command: uptime
      when: reboot_required_file.stat.exists