---
# Full host provisioning — Ansible port of PFVCluster/provisioning/SetupNewSystem.sh
#
# The role order below matches the function call order at the bottom of the
# legacy bash script:
#
#   PreflightCheck            -> roles/preflight
#   global-oam                -> roles/oam
#   global-installPackages    -> roles/packages
#   global-systemServiceConfigurationFiles -> roles/system_config (phase 1)
#   global-postPackageConfiguration         -> roles/system_config (phase 2)
#   secharden-ssh             -> roles/security_ssh
#   secharden-wazuh           -> roles/security_wazuh
#   secharden-scap-stig       -> roles/security_scap_stig
#   secharden-2fa             -> roles/security_2fa
#
# Each role is gated by a feature toggle (see group_vars/all.yml) so the same
# Job Template can be reused for partial runs.

- name: Preflight — verify we may provision this host
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: preflight

- name: OAM — LibreNMS / check_mk agent
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: oam
      when: run_oam | bool

- name: Packages — up2date, install fleet toolset, remove unwanted packages
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: packages
      when: run_packages | bool

- name: System configuration — service config files + post-package tuning
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: system_config
      when: run_system_config | bool

- name: Security hardening — SSH
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: security_ssh
      when: run_security_ssh | bool

- name: Security hardening — Wazuh agent
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: security_wazuh
      when: run_security_wazuh | bool

- name: Security hardening — SCAP/STIG baseline
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: security_scap_stig
      when: run_security_scap_stig | bool

- name: Security hardening — two-factor authentication
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: security_2fa
      when: run_security_2fa | bool

- name: Security hardening — auditd / journald / logrotate
  hosts: all
  gather_facts: true
  become: true
  roles:
    - role: security_audit
      when: run_security_audit | bool