---
# Baza bezpieczeństwa: unattended-upgrades (tylko aktualizacje bezpieczeństwa,
# bez automatycznego restartu — patrz playbook_fleet_report.yml dla flagi reboot-required)
# oraz wyłączenie logowania hasłem po SSH.
- name: Baza bezpieczeństwa (unattended-upgrades + wyłączenie logowania hasłem)
  hosts: all
  gather_facts: true

  tasks:
    - name: Zainstaluj unattended-upgrades (Debian/Ubuntu)
      ansible.builtin.apt:
        name:
          - unattended-upgrades
          - apt-listchanges
        state: present
        update_cache: yes
        cache_valid_time: 3600
      when: ansible_os_family in ["Debian", "Ubuntu"]

    - name: Skonfiguruj unattended-upgrades (tylko aktualizacje bezpieczeństwa, bez auto-reboot)
      ansible.builtin.template:
        src: ../templates/50unattended-upgrades.j2
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
        owner: root
        group: root
        mode: "0644"
      when: ansible_os_family in ["Debian", "Ubuntu"]

    - name: Włącz okresowe aktualizacje APT (20auto-upgrades)
      ansible.builtin.copy:
        dest: /etc/apt/apt.conf.d/20auto-upgrades
        owner: root
        group: root
        mode: "0644"
        content: |
          APT::Periodic::Update-Package-Lists "1";
          APT::Periodic::Unattended-Upgrade "1";
      when: ansible_os_family in ["Debian", "Ubuntu"]

    - name: Wyłącz logowanie hasłem (PasswordAuthentication no)
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '(?i)^\s*#?\s*PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present
        backup: yes
        validate: '/usr/sbin/sshd -t -f %s'
      notify: Restart SSH

    - name: Ogranicz logowanie root do klucza (PermitRootLogin prohibit-password)
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '(?i)^\s*#?\s*PermitRootLogin'
        line: 'PermitRootLogin prohibit-password'
        state: present
        backup: yes
        validate: '/usr/sbin/sshd -t -f %s'
      notify: Restart SSH

  handlers:
    - name: Restart SSH
      ansible.builtin.service:
        name: ssh
        state: restarted