- hosts: all
  gather_facts: yes
  become: yes
  tasks:
    ################## SSH and Security Configuration ##################
    - name: Set SSH configuration permissions
      file:
        path: /etc/ssh/sshd_config
        owner: root
        group: root
        mode: '0600'

    - name: Backup original SSH configuration file (if not exists)
      copy:
        src: /etc/ssh/sshd_config
        dest: /etc/ssh/sshd_config.bak
        owner: root
        group: root
        mode: '0600'
        remote_src: yes
        force: no

    - name: Remove undesired PermitRootLogin and PasswordAuthentication lines
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^(?!#).*PermitRootLogin.*$|^(?!#).*PasswordAuthentication.*$|^(?!#).*PermitEmptyPasswords.*$'
        state: absent

    - name: Apply consolidated SSH config settings
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^(#)?{{ item.key }}"
        line: "{{ item.key }} {{ item.value }}"
        state: present
      loop:
        - { key: "PermitRootLogin", value: "no" }
        - { key: "PasswordAuthentication", value: "no" }
        - { key: "PermitEmptyPasswords", value: "no" }
        - { key: "AllowUsers", value: "miker" }
        - { key: "Protocol", value: "2" }
        - { key: "PubkeyAuthentication", value: "yes" }
        - { key: "Ciphers", value: "aes256-ctr,aes192-ctr,aes128-ctr" }
        - { key: "KexAlgorithms", value: "curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256" }
        - { key: "LoginGraceTime", value: "30" }
        - { key: "X11Forwarding", value: "no" }
        - { key: "AllowTcpForwarding", value: "no" }
        - { key: "PermitUserEnvironment", value: "no" }

    - name: Restart sshd to apply changes
      systemd:
        name: sshd
        state: restarted

    - name: Setup passwordless sudo for sudo group
      lineinfile:
        path: /etc/sudoers
        state: present
        regexp: '^%sudo'
        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
        validate: '/usr/sbin/visudo -cf %s'

    ################## System Package Management ##################
    - name: Update apt cache and upgrade all packages
      apt:
        update_cache: yes
        upgrade: dist
        force_apt_get: yes

    - name: Enable removal of unused dependencies in unattended-upgrades
      lineinfile:
        path: /etc/apt/apt.conf.d/50unattended-upgrades
        regexp: '^Unattended-Upgrade::Remove-Unused-Dependencies'
        line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
        state: present
        create: yes

    - name: Enable auto updates via debconf
      debconf:
        name: unattended-upgrades
        question: unattended-upgrades/enable_auto_updates
        vtype: boolean
        value: 'true'

    - name: Install unattended-upgrades package
      apt:
        name: unattended-upgrades
        state: latest

    - name: Run dpkg reconfigure for unattended-upgrades
      command:
        cmd: dpkg-reconfigure -f noninteractive unattended-upgrades
        creates: /etc/apt/apt.conf.d/20auto-upgrades

    ################## Install and Configure Fail2ban ##################
    - name: Install required system packages including fail2ban
      apt:
        name:
          - curl
          - wget
          - git
          - unattended-upgrades
          - qemu-guest-agent
          - fail2ban
        state: latest
        update_cache: yes

    - name: Setup fail2ban jail.local for sshd
      copy:
        dest: /etc/fail2ban/jail.d/sshd.local
        content: |
          [sshd]
          enabled = true
          port = ssh
          filter = sshd
          logpath = /var/log/auth.log
          maxretry = 3
          bantime = 600
          ignoreip = 127.0.0.1/8 ::1
          action = iptables-multiport
        owner: root
        group: root
        mode: '0644'

    - name: Restart fail2ban service
      systemd:
        name: fail2ban
        state: restarted

    ################## Kernel Update & Reboot ##################
    - name: Check for pending reboot
      stat:
        path: /var/run/reboot-required
      register: reboot_required_file

    - name: Reboot if kernel updated
      reboot:
        msg: "Reboot initiated by Ansible for kernel updates"
        connect_timeout: 5
        reboot_timeout: 300
        pre_reboot_delay: 0
        post_reboot_delay: 30
        test_command: uptime
      when: reboot_required_file.stat.exists