- name: Upgrade all packages
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600
    upgrade: dist

- name: Install base packages
  ansible.builtin.apt:
    name:
      - unattended-upgrades
      - locales
    state: present

- name: Remove services we don't need
  ansible.builtin.apt:
    name:
      - avahi-daemon
      - bluez
    state: absent
    purge: true

- name: Turn on automatic security updates
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
    mode: "0644"

- name: Generate the system locale
  ansible.builtin.lineinfile:
    path: /etc/locale.gen
    regexp: "^#?\\s*{{ base_locale }} UTF-8"
    line: "{{ base_locale }} UTF-8"
  notify: Regenerate locales

- name: Set the system locale
  ansible.builtin.copy:
    dest: /etc/locale.conf
    content: "LANG={{ base_locale }}\n"
    mode: "0644"

- name: Stop accepting locale variables from SSH clients
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^AcceptEnv'
    state: absent
  notify: Restart ssh

- name: SSH hardening
  ansible.builtin.copy:
    dest: /etc/ssh/sshd_config.d/10-hardening.conf
    content: |
      PermitRootLogin no
      AllowUsers @ADMIN_USER@
      AuthenticationMethods publickey
      PasswordAuthentication no
      KbdInteractiveAuthentication no
      X11Forwarding no
      MaxAuthTries 3
      LoginGraceTime 30
    mode: "0644"
  notify: Restart ssh

- name: Create the timesyncd drop-in directory
  ansible.builtin.file:
    path: /etc/systemd/timesyncd.conf.d
    state: directory
    mode: "0755"

- name: Take time from the firewall
  ansible.builtin.copy:
    dest: /etc/systemd/timesyncd.conf.d/firewall.conf
    content: |
      [Time]
      NTP=192.168.5.1
    mode: "0644"
  notify: Restart timesyncd

- name: Disable Wi-Fi and Bluetooth in firmware
  ansible.builtin.blockinfile:
    path: /boot/firmware/config.txt
    marker: "# {mark} ANSIBLE base role"
    block: |
      [all]
      dtoverlay=disable-wifi
      dtoverlay=disable-bt
  notify: Reboot