---
- name: Hardening SSH i Firewall
  hosts: all
  become: true
  gather_facts: false

  tasks:
    - name: Sprawdzenie portu SSH
      when: not (skip | default(false))
      block:
        - name: Wait for SSH
          ansible.builtin.wait_for:
            host: "{{ ansible_host | default(inventory_hostname) }}"
            port: "{{ ansible_port | default(22) }}"
            timeout: 3
          delegate_to: localhost
        - ansible.builtin.set_fact: host_is_online: true
      rescue:
        - ansible.builtin.set_fact: host_is_online: false

    - name: Zabezpieczanie SSH
      when:
        - not (skip | default(false))
        - host_is_online | default(false)
      ignore_unreachable: true
      block:
        - name: Wyłączenie logowania hasłem w SSH
          ansible.builtin.lineinfile:
            path: /etc/ssh/sshd_config
            regexp: '^#?PasswordAuthentication'
            line: 'PasswordAuthentication no'

        - name: Wyłączenie root login przez SSH
          ansible.builtin.lineinfile:
            path: /etc/ssh/sshd_config
            regexp: '^#?PermitRootLogin'
            line: 'PermitRootLogin prohibit-password'

        - name: Restart usługi SSH (Debian/Ubuntu)
          ansible.builtin.service:
            name: ssh
            state: restarted
          when: ansible_os_family | default('') == 'Debian'