- fail:
    msg: possibly wrong server?
  when: ansible_distribution != 'Debian'
  
- name: set hostname
  hostname:
    name: "{{inventory_hostname}}"

- name: set timezone
  timezone:
    name: "{{tz}}"

- name: basics
  apt:
    pkg:
      - locales
      - acl

- name: set locales
  locale_gen:
    name: "{{item.locale}}"
    state: present
  with_items:
    - locale: "cs_CZ.UTF-8"
    - locale: "sk_SK.UTF-8"
    - locale: "en_DK.UTF-8"
    - locale: "en_US.UTF-8"

- name: enable timesyncd
  service:
    name: systemd-timesyncd
    state: started
    masked: no
    enabled: yes

- name: journald - Create dir for persistent logs
  file:
    state: directory
    path: /var/log/journal
    owner: root
    group: systemd-journal
    mode: 02755
  register: journal_dir_created

- name: journald - set ACL for persistent log dir
  ansible.posix.acl:
    path:  /var/log/journal
    state: present
    default: '{{item.1}}'
    etype: group
    entity: '{{item.0}}'
    permissions: rx
    recursive: yes
    # mask is inherited from group permissions, don't set it so we dont' end up
    # with executable files
    recalculate_mask: no_mask
  loop: '{{["adm", "sudo"] | product(["yes", "no"]) | list}}'

- name: journald - config override dir
  file:
    state: directory
    path: /etc/systemd/journald.conf.d
    mode: 0755

- name: journald - make sure Debian does not do something foolish with the defaults
  copy:
    dest: /etc/systemd/journald.conf.d/zzz-default-storage.conf
    content: |
      ## managed by ansible
      # ensure log works even if system's default configuration changes
      [Journal]
      Storage=auto
  register: journal_settings_changed

- name: journald - restart if settings changed
  systemd:
    state: restarted
    name: systemd-journald
  when: journal_dir_created.changed or journal_settings_changed.changed

- name: journald - drop rsyslog, it is not needed
  apt:
    pkg:
      - rsyslog
    state: absent

- name: install authentication
  apt:
    pkg:
      - libnet-ldap-perl
      - krb5-config
      - krb5-user
      - oidentd

- name: authenticate using kerberos
  apt:
    pkg:
      - libpam-krb5
    state: '{{ "present" if pam_use_kerberos else "absent" }}'

- name: setup kerberos
  copy:
    src: krb5.conf
    dest: /etc/krb5.conf

- name: install nftables
  apt:
    name: nftables

- name: enable & start nftables
  systemd:
    enabled: true
    state: started
    name: nftables


- name: nftables config
  template:
    src: nftables.conf.j2
    dest: /etc/nftables.conf
    validate: nft --check -f %s
  notify:
    - restart nftables
  when: nftables_default_config

- name: setup dhcpcd
  block:
    - name: install dhcpcd
      apt:
        pkg:
          - dhcpcd5
      notify:
        - restart dhcpcd

    - name: setup dhcpcd
      template:
        src: dhcpcd.conf.j2
        dest: /etc/dhcpcd.conf
      notify:
        - restart dhcpcd
  when: dhcpcd

- name: '{{"Install" if postfix or mail_relay is none else "Remove"}} postfix'
  apt:
    pkg:
      - postfix
    state: '{{"present" if postfix or mail_relay is none else "absent"}}'
  notify:
    - test mail

- name: '{{"Remove" if postfix or mail_relay is none else "Install"}} MSMTP'
  apt:
    pkg:
      - msmtp
      - msmtp-mta
    state: '{{"absent" if postfix or mail_relay is none else "present"}}'
  notify:
    - test mail

- name: install mail
  apt:
    pkg:
      - bsd-mailx

- name: setup msmtp mail relay
  template:
    src: msmtprc.j2
    dest: /etc/msmtprc
  notify:
    - test mail
  when: not postfix and mail_relay is not none

- name: setup postfix
  template:
    src: postfix/main.cf.j2
    dest: /etc/postfix/main.cf
  notify:
    - test mail
  register: posfix_config
  when: postfix or mail_relay is none

- name: Mail alias
  block:
    - stat:
        path: /etc/aliases
      register: stat_aliases

    - name: 'root mail alias'
      lineinfile:
        path: /etc/aliases
        regexp: "^root:"
        line: "root: {{admin_email}}"
      register: root_mail_alias
      when: stat_aliases.stat.isreg is defined and stat_aliases.stat.isreg

    - name: "reindex aliases"
      command: newaliases
      when: root_mail_alias.changed or posfix_config.changed
  # not for msmtp
  when: postfix or mail_relay is none

- name: Set SSHD config
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '{{item.regexp}}'
    line: '{{item.line}}'
  loop:
    - regexp: '^#?PermitRootLogin'
      line: 'PermitRootLogin prohibit-password'
    - regexp: '^#?MaxAuthTries'
      line: "MaxAuthTries 16"  # for the sake of having multiple keys
    - regexp: '^#?X11Forwarding'
      line: "X11Forwarding yes"
    - regexp: '^#?ChallengeResponseAuthentication'
      line: "ChallengeResponseAuthentication no"

- name: install base utilities
  apt:
    pkg:
      - lvm2
      - xfsprogs
      - xfsdump
      - dosfstools
      - btrfs-progs
      - rsync
      - strace
      - sudo
      - screen
      - tcpdump
      - arping
      - arch-install-scripts
      - gnupg
      - curl
      - wget
      - zstd
      - p7zip
      - unzip
      - zip
      - tree
      - build-essential
      - apt-file
      - vim
      - bash-completion
      - python-is-python3
      - python-dev-is-python3
      - python3-pip
      - libffi-dev
      - autoconf
      - pv
      - arch-install-scripts
      - nmap
      - eject
      - bwm-ng
      - fd-find
      - lm-sensors
      - fancontrol
      - usbutils
      - picocom
      - duperemove
      - lsof
      - moreutils
      - grc
      - bat
      - iotop
      - socat
      - ethtool
      - libunistring-dev

- name: monitoring
  apt:
    name: smartmontools

- name: disk monitoring
  template:
    src: smartd.conf.j2
    dest: /etc/smartd.conf
  notify: restart smartd

- name: install apt extras
  apt:
    pkg:
      - unattended-upgrades
      - apt-listchanges

- name: set upattended upgrades
  lineinfile:
    path: /etc/apt/apt.conf.d/50unattended-upgrades
    regexp: '{{item.regexp}}'
    line: '{{item.line}}'
    backrefs: yes
  with_items:
    - regexp: '^(//)?Unattended-Upgrade::Mail'
      line: 'Unattended-Upgrade::Mail "{{admin_email}}";'
    - regexp: '(//)?(.*label=Debian";)'
      line: '\2'

- name: enable unattended upgrades
  copy:
    content: |
        APT::Periodic::Update-Package-Lists "1";
        APT::Periodic::Unattended-Upgrade "1";
    dest: /etc/apt/apt.conf.d/20auto-upgrades
  
- name: setup root profile
  copy:
    src: "{{item.src}}"
    dest: "{{item.dest}}"
  with_items:
    - src: bash_profile
      dest: /root/.bash_profile
    - src: bashrc
      dest: /root/.bashrc
    - src: vimrc
      dest: /root/.vimrc
    - src: screenrc
      dest: /root/.screenrc

- name: Debian backports repository
  apt_repository:
    repo: deb http://deb.debian.org/debian bullseye-backports main
    filename: backports
    state: present
  when: backports or backports_git

- name: Update git from backports
  apt:
    default_release: '{{"bullseye-backports" if backports_git else "bullseye"}}'
    pkg:
      - git
    state: latest

- name: Benchmarking
  apt:
    pkg:
      - sysbench

- name: LVM logging
  lineinfile:
    path: /etc/lvm/lvm.conf
    regexp: '^([ \t]*)(# )?{{item.key}} ='
    line: '\1{{item.key}} = {{item.value}} ## set by ansible'
    backrefs: true
  with_items:
    - key: 'syslog'
      value: '1'
    - key: 'level'
      value: '3'

- name: Log monitoring
  block:
    - name: "Monitor group"
      group:
        name: "mon"
        system: true

    - name: "Monitor user"
      user:
        name: "mon"
        system: true
        create_home: true
        home: "/srv/mon"
        shell: "/usr/sbin/nologin"
        group: "mon"
        groups: ["systemd-journal"]

    - name: "Monitoring journal, disks"
      template:
        src: "{{item}}.j2"
        dest: "/usr/bin/{{item}}"
        mode: "u=rx,g=rx,o=rx"
      loop:
        - "journal-checker"
        - "dfwatch"

    - name: "Cron monitoring setup – mail"
      cron:
        user: "mon"
        env: true
        name: "MAILTO"
        job: "{{admin_email}}"

    - name: "Cron monitoring setup – jobs"
      cron:
        user: "mon"
        name: "{{item.1}}"
        special_time: "{{item.0}}"
        job: "/usr/bin/{{item.1}}"
      loop:
        - ["hourly", "journal-checker"]
        - ["daily", "dfwatch"]
