---
- name: "Configure base system parameters"
  hosts: all

  vars:
    apt_packages:
      - acl
      - curl
      - fuse
      - git
      - htop
      - jq
      - make
      - python3-croniter
      - python3-pip
      - python3-requests
      - sqlite3
      - tree

  tasks:
    - name: "Install additional apt packages"
      ansible.builtin.apt:
        name: "{{ apt_packages }}"
        update_cache: true

    - name: "Configure security settings"
      ansible.builtin.import_role:
        name: geerlingguy.security
      vars:
        # Root по SSH не нужен: ansible ходит под непривилегированным major с
        # become. Заодно defense-in-depth — если PasswordAuthentication когда-то
        # вернётся в "yes", root не откроется по паролю.
        security_ssh_permit_root_login: "no"
        # unattended-upgrades: шаблон роли ограничен security-репозиториями,
        # автоматическая перезагрузка выключена дефолтом роли.
        security_autoupdate_enabled: true
        security_fail2ban_enabled: true

    - name: "Create systemd journald drop-in directory"
      ansible.builtin.file:
        path: /etc/systemd/journald.conf.d
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: "Limit systemd journal size"
      ansible.builtin.copy:
        content: |
          # Managed by ansible (playbook-system.yml)
          # Без потолка journald занимает до 10% ФС.
          [Journal]
          SystemMaxUse=500M
        dest: /etc/systemd/journald.conf.d/99-max-use.conf
        owner: root
        group: root
        mode: "0644"
      notify: "Restart systemd-journald"

    - name: "Copy keep files script"
      ansible.builtin.copy:
        src: "files/keep-files.py"
        dest: "{{ bin_prefix }}/keep-files.py"
        owner: root
        group: root
        mode: "0755"

    - name: 'Create directory for applications'
      ansible.builtin.file:
        path: '{{ application_dir }}'
        state: 'directory'
        mode: '0755'
      tags:
        - mount-storage

    - name: 'Mount external storages'
      ansible.posix.mount:
        path: '{{ application_dir }}'
        src: 'UUID=3942bffd-8328-4536-8e88-07926fb17d17'
        fstype: ext4
        state: mounted
      when: mount_external_storage | default(false) | bool
      tags:
        - mount-storage

  handlers:
    - name: "Restart systemd-journald"
      ansible.builtin.systemd_service:
        name: systemd-journald
        state: restarted