stack/ansible/roles/common/tasks/main.yml

---
- name: Set system timezone
  community.general.timezone:
    name: "{{ timezone }}"
  tags: [common, timezone]

- name: Wait for any existing unattended-upgrade / dpkg lock
  ansible.builtin.shell: |
    while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
       || fuser /var/lib/apt/lists/lock >/dev/null 2>&1; do
      sleep 5
    done
  changed_when: false
  tags: [common, apt]

- name: Update apt cache
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600
  tags: [common, apt]

- name: Upgrade all packages
  ansible.builtin.apt:
    upgrade: dist
    autoremove: true
    autoclean: true
  tags: [common, apt, upgrade]

- name: Install essential packages (curl wget nano build-essential net-tools)
  ansible.builtin.apt:
    name: "{{ essential_packages }}"
    state: present
  tags: [common, packages, essentials]

- name: Install common packages
  ansible.builtin.apt:
    name: "{{ common_packages }}"
    state: present
  tags: [common, packages]

# ---------------------------------------------------------------------------
# Microsoft Edit — terminal-based editor (https://github.com/microsoft/edit)
# ---------------------------------------------------------------------------
- name: Resolve Microsoft Edit archive name for this arch
  ansible.builtin.set_fact:
    ms_edit_arch_triple: >-
      {{
        'x86_64-linux-gnu' if ansible_architecture in ['x86_64', 'amd64']
        else (
          'aarch64-linux-gnu' if ansible_architecture in ['aarch64', 'arm64']
          else 'UNSUPPORTED'
        )
      }}
  when: ms_edit_install | bool
  tags: [common, packages, edit]

- name: Fail if Microsoft Edit has no binary for this architecture
  ansible.builtin.fail:
    msg: "No Microsoft Edit release for architecture {{ ansible_architecture }}"
  when:
    - ms_edit_install | bool
    - ms_edit_arch_triple == 'UNSUPPORTED'
  tags: [common, packages, edit]

- name: Check whether Microsoft Edit is already installed at the desired version
  ansible.builtin.command: /usr/local/bin/edit --version
  register: ms_edit_installed
  changed_when: false
  failed_when: false
  when: ms_edit_install | bool
  tags: [common, packages, edit]

- name: Download Microsoft Edit release tarball
  ansible.builtin.get_url:
    url: >-
      https://github.com/microsoft/edit/releases/download/v{{ ms_edit_version }}/edit-{{ ms_edit_version }}-{{ ms_edit_arch_triple | trim }}.tar.gz
    dest: "/tmp/edit-{{ ms_edit_version }}.tar.gz"
    mode: "0644"
  when:
    - ms_edit_install | bool
    - ms_edit_installed.rc is not defined or ms_edit_installed.rc != 0
      or (ms_edit_version not in (ms_edit_installed.stdout | default('')))
  tags: [common, packages, edit]

- name: Install Microsoft Edit binary to /usr/local/bin/edit
  ansible.builtin.unarchive:
    src: "/tmp/edit-{{ ms_edit_version }}.tar.gz"
    dest: /usr/local/bin
    remote_src: true
    mode: "0755"
    owner: root
    group: root
  when:
    - ms_edit_install | bool
    - ms_edit_installed.rc is not defined or ms_edit_installed.rc != 0
      or (ms_edit_version not in (ms_edit_installed.stdout | default('')))
  tags: [common, packages, edit]

- name: Verify Microsoft Edit is on PATH
  ansible.builtin.command: /usr/local/bin/edit --version
  register: ms_edit_verify
  changed_when: false
  failed_when: ms_edit_verify.rc != 0
  when: ms_edit_install | bool
  tags: [common, packages, edit]

- name: Show Microsoft Edit version
  ansible.builtin.debug:
    msg: "{{ ms_edit_verify.stdout | default(ms_edit_installed.stdout) | default('edit installed') }}"
  when: ms_edit_install | bool
  tags: [common, packages, edit]

- name: Enable unattended-upgrades
  ansible.builtin.debconf:
    name: unattended-upgrades
    question: unattended-upgrades/enable_auto_updates
    value: "true"
    vtype: boolean
  tags: [common, unattended]

- name: Configure unattended-upgrades (security only)
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    mode: "0644"
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
      APT::Periodic::AutocleanInterval "7";
  tags: [common, unattended]

- name: Prefer security updates in unattended-upgrades
  ansible.builtin.lineinfile:
    path: /etc/apt/apt.conf.d/50unattended-upgrades
    regexp: '{{ item.regexp }}'
    line: '{{ item.line }}'
    state: present
  loop:
    - regexp: '^\s*//\s*"\$\{distro_id\}:\$\{distro_codename\}-security";'
      line: '        "${distro_id}:${distro_codename}-security";'
    - regexp: 'Unattended-Upgrade::Remove-Unused-Dependencies'
      line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
  failed_when: false
  tags: [common, unattended]

- name: Enable and start fail2ban
  ansible.builtin.service:
    name: fail2ban
    state: started
    enabled: true
  tags: [common, fail2ban]

- name: Fail2ban SSH jail (sshd)
  ansible.builtin.copy:
    dest: /etc/fail2ban/jail.d/sshd.local
    mode: "0644"
    content: |
      [sshd]
      enabled = true
      port = ssh
      filter = sshd
      maxretry = 5
      bantime = 1h
      findtime = 10m
  notify: Restart fail2ban
  tags: [common, fail2ban]

- name: Ensure plocate database is built
  ansible.builtin.command: updatedb
  changed_when: false
  failed_when: false
  tags: [common]

- name: Detect sensors (lm-sensors)
  ansible.builtin.command: sensors-detect --auto
  args:
    creates: /etc/sensors3.conf
  failed_when: false
  changed_when: false
  tags: [common]