# ------------------------------------------------------------------------------
# FILE: roles/common/tasks/main.yml
# DESCRIPTION: Baseline configuration applied to all managed hosts.
#              Handles hostname, timezone, core packages, NTP, and
#              ansible user setup.
# ------------------------------------------------------------------------------

- name: Set hostname
  hostname:
    name: "{{ inventory_hostname | replace('_', '-') }}"

- name: Set timezone
  timezone:
    name: "{{ common_timezone }}"

- name: Update apt cache
  apt:
    update_cache: yes
    cache_valid_time: 3600

- name: Install base utility packages
  apt:
    name: "{{ common_packages }}"
    state: present

- name: Install chrony
  apt:
    name: chrony
    state: present

- name: Configure chrony to use sundial
  template:
    src: chrony.conf.j2
    dest: /etc/chrony/chrony.conf
    mode: '0644'
  notify: restart chrony

- name: Ensure chrony is enabled and running
  systemd:
    name: chrony
    state: started
    enabled: yes

- name: Ensure ansible user has sudo without password
  lineinfile:
    path: /etc/sudoers.d/{{ ansible_user }}
    line: "{{ ansible_user }} ALL=(ALL) NOPASSWD:ALL"
    create: yes
    mode: '0440'
    validate: 'visudo -cf %s'

# --- Step-CA SSH certificate enrollment ---
- name: Enroll host in step-ca SSH CA
  include_tasks: step_ca_client.yml