- name: Install common packages
  apt:
    name: 
      - aptitude
      - jq
    state: latest
    update_cache: true

- name: UFW - Enable and deny by default
  community.general.ufw:
    state: enabled
    default: deny
# Security updates install themselves each day (Debian's default origins:
# the -security archive only). No automatic reboots.
- name: Install unattended-upgrades
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present

- name: Turn on daily unattended upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    owner: root
    mode: '0644'
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";

# Keys only. sshd_config's Include comes first and sshd keeps the first value
# it reads, so this drop-in overrides the defaults further down. Root has no
# keys, and Ansible logs in as the regular user.
- name: SSH - keys only, no root login, no X11
  ansible.builtin.copy:
    dest: /etc/ssh/sshd_config.d/10-hardening.conf
    owner: root
    mode: '0644'
    content: |
      PasswordAuthentication no
      KbdInteractiveAuthentication no
      PermitRootLogin no
      X11Forwarding no
    validate: /usr/sbin/sshd -t -f %s
  notify: reload ssh