---
# Full rollout of all roles.
# Full run:    ansible-playbook playbooks/site.yml --ask-vault-pass
# Dry run:     ansible-playbook playbooks/site.yml --check --diff
# Subset only: ansible-playbook playbooks/site.yml --tags hardening

- name: Deploy hardened Linux baseline configuration
  hosts: linux_all
  become: true
  vars_files:
    - ../vault/secrets.yml
  roles:
    - role: base_os
      tags: [base_os]
    - role: repo_management
      tags: [repo_management]
    - role: identity_ad
      tags: [identity_ad, hardening]
    - role: sudo_rbac
      tags: [sudo_rbac, hardening]
    - role: local_accounts
      tags: [local_accounts, hardening]
    - role: banners
      tags: [banners, hardening]
    - role: ssh_hardening
      tags: [ssh_hardening, hardening]
    - role: fail2ban
      tags: [fail2ban, hardening]
    - role: pam_hardening
      tags: [pam_hardening, hardening]
    - role: cis_hardening
      tags: [cis_hardening, hardening]
    - role: selinux_config
      tags: [selinux_config, hardening]
      when: ansible_facts['os_family'] == "RedHat"
    - role: apparmor_config
      tags: [apparmor_config, hardening]
      when: ansible_facts['os_family'] == "Debian"
    - role: firewall_config
      tags: [firewall_config, hardening]
    - role: falcon_onboarding
      tags: [falcon_onboarding, hardening]
    - role: logging_rsyslog
      tags: [logging_rsyslog, monitoring]
    - role: aide_integrity
      tags: [aide_integrity, monitoring]
    - role: patch_mgmt
      tags: [patch_mgmt, patching]
    - role: backup_agent
      tags: [backup_agent]
      when: veeam_agent_enabled | default(false) | bool