---
- name: Include OS-family-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - "default.yml"
  tags: [pam_hardening, always]

- name: Ensure pwquality library is installed
  ansible.builtin.package:
    name: "{{ pam_hardening_pwquality_package }}"
    state: present
  tags: [pam_hardening]

- name: Set password complexity requirements
  ansible.builtin.lineinfile:
    path: /etc/security/pwquality.conf
    regexp: "^#?\\s*{{ item.key }}\\s*="
    line: "{{ item.key }} = {{ item.value }}"
  loop:
    - { key: "minlen", value: "{{ pam_pwquality_minlen }}" }
    - { key: "dcredit", value: "{{ pam_pwquality_dcredit }}" }
    - { key: "ucredit", value: "{{ pam_pwquality_ucredit }}" }
    - { key: "lcredit", value: "{{ pam_pwquality_lcredit }}" }
    - { key: "ocredit", value: "{{ pam_pwquality_ocredit }}" }
    - { key: "retry", value: "{{ pam_pwquality_retry }}" }
  tags: [pam_hardening]

- name: Enable pam_faillock via authselect (RedHat family)
  ansible.builtin.command: authselect enable-feature with-faillock
  register: pam_hardening_faillock_enable
  changed_when: "'already enabled' not in pam_hardening_faillock_enable.stderr"
  failed_when: false
  when: ansible_facts['os_family'] == "RedHat"
  tags: [pam_hardening]

- name: Check whether pam_faillock is already enabled (Debian family)
  ansible.builtin.command: grep -q pam_faillock.so /etc/pam.d/common-auth
  register: pam_hardening_faillock_check
  changed_when: false
  failed_when: false
  when: ansible_facts['os_family'] == "Debian"
  tags: [pam_hardening]

- name: Enable pam_faillock via pam-auth-update (Debian family)
  ansible.builtin.command: pam-auth-update --enable faillock
  register: pam_hardening_faillock_debian
  changed_when: true
  failed_when: false
  when:
    - ansible_facts['os_family'] == "Debian"
    - pam_hardening_faillock_check.rc != 0
  tags: [pam_hardening]

- name: Set account lockout thresholds
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: "^#?\\s*{{ item.key }}\\s*="
    line: "{{ item.key }} = {{ item.value }}"
  loop:
    - { key: "deny", value: "{{ pam_faillock_deny }}" }
    - { key: "unlock_time", value: "{{ pam_faillock_unlock_time }}" }
  tags: [pam_hardening]