---
- name: Install ufw and fail2ban
  ansible.builtin.apt:
    name:
      - ufw
      - fail2ban
    state: present

- name: Harden sshd_config - PermitRootLogin
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?PermitRootLogin"
    line: "PermitRootLogin {{ ssh_permit_root_login }}"
  notify: Restart sshd

- name: Harden sshd_config - PasswordAuthentication
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?PasswordAuthentication"
    line: "PasswordAuthentication {{ ssh_password_authentication }}"
  notify: Restart sshd

- name: Set sshd Port
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?Port"
    line: "Port {{ ssh_port }}"
  notify: Restart sshd

- name: Reset ufw defaults (deny incoming, allow outgoing)
  community.general.ufw:
    state: reset
  changed_when: false

- name: Set ufw default policies
  community.general.ufw:
    direction: "{{ item.direction }}"
    policy: "{{ item.policy }}"
  loop:
    - { direction: incoming, policy: deny }
    - { direction: outgoing, policy: allow }

- name: Allow required TCP ports through ufw
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop: "{{ (ufw_allowed_tcp_ports + ufw_allowed_tcp_ports_extra) | unique }}"

- name: Enable ufw
  community.general.ufw:
    state: enabled

- name: Ensure fail2ban is running and enabled
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: true