- name: SSH HARDENNING
  hosts: prod,pre-prod,replica-prod,infra,infra-runner,infra-utils,ota-uber,load-balancer,!backup-mln
  become: true
  gather_facts: true
  tasks:
      - name: Créer le groupe ssh
        ansible.builtin.group:
            name: ssh
            state: present

      - ansible.builtin.user:
            name: "{{ user_ssh }}"
            shell: /bin/bash
            groups:
                - sudo
                - ssh
            append: true
            state: present
            password: "{{ password_user_ssh }}"
            update_password: on_create
            create_home: true
            home: /home/omnex
        no_log: true

      - name: Check si la paire de clé SSH existe
        ansible.builtin.stat:
            path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
        delegate_to: localhost
        become: false
        register: ssh_key_check
        tags: [key]

      - name: Générer la paire de clés SSH localement
        community.crypto.openssh_keypair:
            path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
            type: ed25519
        delegate_to: localhost
        become: false
        when: not ssh_key_check.stat.exists
        run_once: true
        tags: [key]

      - ansible.posix.authorized_key:
          user: "{{ user_ssh }}"
          state: present
          key: "{{ lookup('file', playbook_dir + '/../.ssh/' + user_ssh + '.pub') }}"

      - name: Déployer la config sshd durcie
        ansible.builtin.template:
            src: ../templates/ssh_harden_conf.j2
            dest: /etc/ssh/sshd_config
            mode: "0600"
            owner: root
            group: root
            validate: /usr/sbin/sshd -t -f %s
        notify: restart ssh

      - name: Restreindre les permissions des cles d'hote SSH privees (CIS 5.1.2)
        ansible.builtin.shell: chmod 0600 /etc/ssh/ssh_host_*_key
        changed_when: false

      - name: Restreindre les permissions des cles d'hote SSH publiques (CIS 5.1.3)
        ansible.builtin.shell: chmod 0644 /etc/ssh/ssh_host_*_key.pub
        changed_when: false

      - name: Delete cloud ssh config if exists
        ansible.builtin.file:
            path: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
            state: absent

      - name: Déployer la config cloud-init durcie
        ansible.builtin.template:
            src: ../templates/cloud_harden.conf.j2
            dest: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
            mode: "0644"
            owner: root
            group: root
        notify: restart ssh

  handlers:
      - name: restart ssh
        ansible.builtin.service:
            name: ssh
            state: restarted