---
# ============================================================================
# linux-baseline / main entrypoint
# ============================================================================
# Orchestrates baseline application. Each capability sits behind a
# feature flag in baseline_features so individual concerns can be
# disabled per-host without forking the role.
# ============================================================================

- name: Preflight checks
  ansible.builtin.import_tasks: preflight.yml
  tags: [baseline, preflight, always]

- name: Load OS-family-specific variables
  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
  tags: [baseline, always]

- name: Apply package baseline
  ansible.builtin.import_tasks: packages.yml
  when: baseline_features.packages | bool
  tags: [baseline, packages]

- name: Configure timezone and locale
  ansible.builtin.import_tasks: timezone.yml
  when: baseline_features.timezone | bool
  tags: [baseline, timezone]

- name: Configure time synchronisation
  ansible.builtin.import_tasks: time_sync.yml
  when: baseline_features.time_sync | bool
  tags: [baseline, time-sync]

- name: Provision baseline users
  ansible.builtin.import_tasks: users.yml
  when: baseline_features.users | bool
  tags: [baseline, users]

- name: Harden SSH
  ansible.builtin.import_tasks: ssh_hardening.yml
  when: baseline_features.ssh_hardening | bool
  tags: [baseline, ssh, hardening]

- name: Configure unattended security upgrades
  ansible.builtin.import_tasks: unattended_upgrades.yml
  when:
    - baseline_features.unattended_upgrades | bool
    - ansible_os_family == "Debian"
  tags: [baseline, unattended-upgrades]

- name: Apply sysctl baseline
  ansible.builtin.import_tasks: sysctl.yml
  when: baseline_features.sysctl | bool
  tags: [baseline, sysctl]

- name: Configure journald retention
  ansible.builtin.import_tasks: journald.yml
  when: baseline_features.journald | bool
  tags: [baseline, journald]

- name: Apply MOTD branding
  ansible.builtin.import_tasks: motd.yml
  when: baseline_features.motd | bool
  tags: [baseline, motd]