---
# Post-deployment sanity checks. Read-only, makes no changes.
# Run: ansible-playbook playbooks/verify.yml

- name: Verify baseline hardening status
  hosts: linux_all
  become: true
  gather_facts: true
  tasks:
    - name: Collect service facts
      ansible.builtin.service_facts:

    - name: Check expected services are running
      ansible.builtin.assert:
        that:
          - "'sshd.service' in ansible_facts.services"
          - "ansible_facts.services['sshd.service'].state == 'running'"
          - "'firewalld.service' in ansible_facts.services"
          - "ansible_facts.services['firewalld.service'].state == 'running'"
          - "'auditd.service' in ansible_facts.services"
          - "ansible_facts.services['auditd.service'].state == 'running'"
        fail_msg: "One or more expected core services are not running."
        success_msg: "Core services (sshd, firewalld, auditd) are running."

    - name: Check SELinux is enforcing (RedHat family)
      ansible.builtin.command: getenforce
      register: verify_selinux_status
      changed_when: false
      when: ansible_facts['os_family'] == "RedHat"

    - name: Assert SELinux enforcing (RedHat family)
      ansible.builtin.assert:
        that:
          - "verify_selinux_status.stdout == 'Enforcing'"
        fail_msg: "SELinux is not in enforcing mode."
        success_msg: "SELinux is enforcing."
      when: ansible_facts['os_family'] == "RedHat"

    - name: Check AppArmor status (Debian family)
      ansible.builtin.command: aa-status --enforced
      register: verify_apparmor_status
      changed_when: false
      failed_when: false
      when: ansible_facts['os_family'] == "Debian"

    - name: Report AppArmor enforced profile count (Debian family)
      ansible.builtin.debug:
        msg: "AppArmor enforced profiles on {{ inventory_hostname }}: {{ verify_apparmor_status.stdout | default('unavailable') }}"
      when: ansible_facts['os_family'] == "Debian"

    - name: Check CrowdStrike Falcon sensor health
      ansible.builtin.command: /opt/CrowdStrike/falconctl -g --rfm-state
      register: verify_falcon_rfm
      changed_when: false
      failed_when: false

    - name: Report Falcon sensor status
      ansible.builtin.debug:
        msg: "Falcon sensor RFM state on {{ inventory_hostname }}: {{ verify_falcon_rfm.stdout | default('not installed / not reachable') }}"

    - name: Check AIDE database exists (RedHat family)
      ansible.builtin.stat:
        path: /var/lib/aide/aide.db.gz
      register: verify_aide_db_redhat
      when: ansible_facts['os_family'] == "RedHat"

    - name: Check AIDE database exists (Debian family)
      ansible.builtin.stat:
        path: /var/lib/aide/aide.db
      register: verify_aide_db_debian
      when: ansible_facts['os_family'] == "Debian"

    - name: Assert AIDE database is present
      ansible.builtin.assert:
        that:
          - (verify_aide_db_redhat.stat.exists | default(false)) or (verify_aide_db_debian.stat.exists | default(false))
        fail_msg: "AIDE database has not been initialized."
        success_msg: "AIDE database is present."