---
# Baseline hardening applied to both rn-platform-01 and rn-lab-host-01 before anything
# RootNode-specific — idempotent, safe to re-run (Phase 4 §20 requirement).

- name: Set timezone
  community.general.timezone:
    name: "{{ common_timezone }}"

- name: Install base packages
  ansible.builtin.apt:
    name:
      - curl
      - ca-certificates
      - gnupg
      - iptables
      - iptables-persistent
      - unattended-upgrades
      - fail2ban
      - jq
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Enable unattended security upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
    mode: "0644"
  when: common_unattended_upgrades

- name: Create the rootnode-deploy service account (if not the connecting user already)
  ansible.builtin.user:
    name: rootnode-deploy
    shell: /bin/bash
    groups: docker
    append: true
    create_home: true
  register: deploy_user_result
  failed_when: false   # non-fatal — some hosts may already use this as ansible_user

- name: Ensure fail2ban is enabled for SSH
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: true

- name: Create /opt/rootnode and /etc/rootnode base directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0750"
  loop:
    - /opt/rootnode
    - /etc/rootnode