---
- name: Include OS-family-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - "default.yml"
  tags: [base_os, always]

- name: Update apt cache
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600
  when: ansible_facts['os_family'] == "Debian"
  tags: [base_os]

- name: Install base packages
  ansible.builtin.package:
    name: "{{ base_os_packages + (base_extra_packages | default([])) }}"
    state: present
  tags: [base_os]

- name: Set timezone
  community.general.timezone:
    name: "{{ timezone }}"
  tags: [base_os]

- name: Deploy chrony configuration
  ansible.builtin.template:
    src: chrony.conf.j2
    dest: "{{ base_os_chrony_config_path }}"
    owner: root
    group: root
    mode: "0644"
  notify: restart chrony
  tags: [base_os]

- name: Enable and start chrony
  ansible.builtin.systemd:
    name: "{{ base_os_chrony_service_name }}"
    enabled: true
    state: started
  tags: [base_os]

- name: Set hostname from inventory
  ansible.builtin.hostname:
    name: "{{ inventory_hostname }}"
  tags: [base_os]

- name: Remove unwanted packages
  ansible.builtin.package:
    name: "{{ base_os_unwanted_packages }}"
    state: absent
  tags: [base_os, cis_hardening]

- name: Gather service facts
  ansible.builtin.service_facts:
  tags: [base_os]

- name: Disable unneeded services if installed
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: false
    state: stopped
  loop: "{{ base_unneeded_services }}"
  when: (item + '.service') in ansible_facts.services
  tags: [base_os]

- name: Deploy post-login MOTD
  ansible.builtin.template:
    src: motd.j2
    dest: /etc/motd
    owner: root
    group: root
    mode: "0644"
  tags: [base_os]