# code: language=ansible

- name: Disable link local addressing
  ansible.builtin.lineinfile:
    backrefs: false
    backup: true
    create: false
    encoding: "utf-8"
    firstmatch: true
    group: root
    insertafter: '^\[Network\]\s*$'
    line: "LinkLocalAddressing=no"
    mode: "0664"
    owner: root
    path: "/etc/systemd/network/10-cloud-init-eth0.network"
    regexp: '^LinkLocalAddressing\s*=.*$'
    state: present
  notify:
    - Restart systemd-networkd

- name: Set link wait-online requirements
  ansible.builtin.blockinfile:
    append_newline: true
    backup: true
    block: |
      [Link]
      ActivationPolicy=always-up
      RequiredForOnline=yes
      RequiredFamilyForOnline={{ sshd_required_family_for_online }}
    create: false
    group: root
    insertbefore: '^\[Network\]\s*$'
    mode: "0664"
    owner: root
    path: "/etc/systemd/network/10-cloud-init-eth0.network"
    prepend_newline: true
    state: present

- name: Disable global systemd-networkd-wait-online
  ansible.builtin.systemd_service:
    enabled: false
    name: systemd-networkd-wait-online.service
    scope: system
    state: stopped

- name: Enable instantiated systemd-networkd-wait-online
  ansible.builtin.systemd_service:
    enabled: true
    name: systemd-networkd-wait-online@eth0.service
    scope: system
    state: started

- name: Create sshd.service override directory
  ansible.builtin.file:
    group: root
    mode: "0775"
    owner: root
    path: /etc/systemd/system/sshd.service.d
    state: directory

- name: Create sshd.service override config
  ansible.builtin.copy:
    dest: /etc/systemd/system/sshd.service.d/sshd_override.conf
    group: root
    mode: "0664"
    owner: root
    remote_src: false
    src: "{{ role_path }}/files/sshd_override.conf"
  notify:
    - Restart sshd

- name: Add an ssh group
  ansible.builtin.group:
    local: false
    name: ssh
    state: present
    system: true

- name: Add user to ssh group
  ansible.builtin.user:
    append: true
    groups:
      - ssh
    local: false
    name: "{{ sshd_user }}"
    state: present

- name: Configure sshd_config (IPv4)
  ansible.builtin.lineinfile:
    backrefs: false
    create: true
    encoding: "utf-8"
    firstmatch: false
    group: root
    line: "{{ item.line }}"
    mode: "0664"
    owner: root
    path: "/etc/ssh/sshd_config"
    regexp: "{{ item.pattern }}"
    state: present
  loop: "{{ sshd_ipv4_config_lines }}"
  loop_control:
    label: "{{ item.label }}"
  notify:
    - Restart sshd

- name: Configure sshd_config (IPv6)
  when:
    - not (ipv4_only | default(false))
  ansible.builtin.lineinfile:
    backrefs: false
    create: true
    encoding: "utf-8"
    firstmatch: false
    group: root
    line: "{{ item.line }}"
    mode: "0664"
    owner: root
    path: "/etc/ssh/sshd_config"
    regexp: "{{ item.pattern }}"
    state: present
  loop: "{{ sshd_ipv6_config_lines }}"
  loop_control:
    label: "{{ item.label }}"
  notify:
    - Restart sshd

- name: Install UFW
  community.general.pacman:
    name:
      - ufw
    state: present
    update_cache: true

- name: Configure UFW IPv4 rules
  community.general.ufw:
    comment: "{{ item.comment }}"
    direction: "in"
    from_ip: "{{ item.source }}"
    log: true
    proto: tcp
    rule: "allow"
    to_ip: "{{ ipv4_address }}"
    to_port: "22"
  loop: "{{ sshd_ufw_ipv4_rules }}"
  loop_control:
    label: "{{ item.comment }}"

- name: Configure UFW IPv6 rules
  when:
    - not (ipv4_only | default(false))
  community.general.ufw:
    comment: "{{ item.comment }}"
    direction: "in"
    from_ip: "{{ item.source }}"
    log: true
    proto: tcp
    rule: "allow"
    to_ip: "{{ ipv6_address }}"
    to_port: "22"
  loop: "{{ sshd_ufw_ipv6_rules }}"
  loop_control:
    label: "{{ item.comment }}"

- name: Enable UFW
  community.general.ufw:
    state: enabled

- name: Enable and start UFW service
  ansible.builtin.systemd_service:
    enabled: true
    name: ufw.service
    scope: system
    state: started