---
- name: Install ufw and fail2ban
  ansible.builtin.apt:
    name:
      - ufw
      - fail2ban
    state: present

- name: Harden sshd_config - PermitRootLogin
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?PermitRootLogin"
    line: "PermitRootLogin {{ ssh_permit_root_login }}"
  notify: Restart sshd

- name: Harden sshd_config - PasswordAuthentication
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?PasswordAuthentication"
    line: "PasswordAuthentication {{ ssh_password_authentication }}"
  notify: Restart sshd

- name: Set sshd Port
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?Port"
    line: "Port {{ ssh_port }}"
  notify: Restart sshd

- name: Reset ufw defaults (deny incoming, allow outgoing)
  community.general.ufw:
    state: reset
  changed_when: false

- name: Set ufw default policies
  community.general.ufw:
    direction: "{{ item.direction }}"
    policy: "{{ item.policy }}"
  loop:
    - { direction: incoming, policy: deny }
    - { direction: outgoing, policy: allow }

- name: Allow required TCP ports through ufw
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop: "{{ (ufw_allowed_tcp_ports + ufw_allowed_tcp_ports_extra) | unique }}"

- name: Enable ufw
  community.general.ufw:
    state: enabled

- name: Ensure fail2ban is running and enabled
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: true

- name: Install required packages for netbird
  apt:
    name:
      - curl
      - gnupg
      - ca-certificates
    state: present
    update_cache: false

- name: Configure network buffer sizes (increased speed)
  ansible.posix.sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
    state: present
    reload: true
    ignoreerrors: true
  loop:
    - { key: 'net.core.rmem_max', value: '7500000' }
    - { key: 'net.core.wmem_max', value: '7500000' }

- name: Add repository with key
  ansible.builtin.deb822_repository:
    name: netbird
    types: [deb]
    uris: "https://pkgs.netbird.io/debian"
    components: [main]
    suites: ["stable"]
    signed_by: https://pkgs.netbird.io/debian/public.key
    state: present
    enabled: true

- name: Install netbird
  ansible.builtin.apt:
    name:
      - netbird
    state: present
    update_cache: true

- name: Enable netbird service
  ansible.builtin.systemd:
    name: netbird
    state: started
    enabled: true

- name: Check NetBird status
  ansible.builtin.command: netbird status
  register: netbird_status
  ignore_errors: true
  changed_when: false

- name: Start NetBird if needed
  ansible.builtin.command: netbird up --management-url https://api.netbird.io --setup-key "{{ netbird_setup_key }}"
  when: netbird_status.stdout is search("NeedsLogin") or search ("LoginFailed")
  vars:
    ansible_command_timeout: 3600
  changed_when: true