---
# Security hardening – sysctl, AppArmor, auditd, auto-updates
#
# Použití:
#   ansible-playbook -i inventory.yml playbooks/security-hardening.yml
#
- name: Security hardening
  hosts: homeservers
  become: true

  tasks:
    - name: Kernel hardening via sysctl
      ansible.posix.sysctl:
        name: "{{ item.key }}"
        value: "{{ item.value }}"
        state: present
        reload: true
      loop:
        - { key: "net.ipv4.conf.all.rp_filter", value: "1" }
        - { key: "net.ipv4.conf.default.rp_filter", value: "1" }
        - { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
        - { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
        - { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
        - { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
        - { key: "net.ipv4.conf.all.send_redirects", value: "0" }
        - { key: "net.ipv4.conf.all.accept_source_route", value: "0" }
        - { key: "net.ipv4.conf.default.accept_source_route", value: "0" }
        - { key: "net.ipv4.tcp_syncookies", value: "1" }
        - { key: "net.ipv4.conf.all.log_martians", value: "1" }

    - name: Install unattended-upgrades
      ansible.builtin.apt:
        name:
          - unattended-upgrades
          - apt-listchanges
        state: present

    - name: Enable automatic security updates
      ansible.builtin.copy:
        dest: /etc/apt/apt.conf.d/20auto-upgrades
        content: |
          APT::Periodic::Update-Package-Lists "1";
          APT::Periodic::Unattended-Upgrade "1";
          APT::Periodic::AutocleanInterval "7";
        mode: "0644"

    - name: Install auditd
      ansible.builtin.apt:
        name:
          - auditd
          - audispd-plugins
        state: present

    - name: Enable auditd
      ansible.builtin.service:
        name: auditd
        state: started
        enabled: true