---
# SCAP/STIG baseline hardening — port of Modules/Security/secharden-scap-stig.sh.

# --- GRUB permission hardening (skip on Raspberry Pi) ---
- name: Harden /boot/grub/grub.cfg permissions (non-Pi only)
  ansible.builtin.file:
    path: /boot/grub/grub.cfg
    owner: root
    group: root
    mode: "0400"
  when: not (is_raspi | bool)
  failed_when: false

# --- Disable and purge autofs ---
- name: Disable autofs
  ansible.builtin.systemd:
    name: autofs
    enabled: false
    state: stopped
  failed_when: false

- name: Purge autofs package
  ansible.builtin.apt:
    name: autofs
    state: absent
    purge: true
  failed_when: false

# --- Kernel module blacklisting (modprobe.d) ---
- name: Deploy modprobe blacklists
  ansible.builtin.copy:
    src: "modprobe/{{ item }}"
    dest: "/etc/modprobe.d/{{ item }}"
    owner: root
    group: root
    mode: "0644"
    backup: true
  loop:
    - usb_storage.conf
    - dccp.conf
    - rds.conf
    - sctp.conf
    - tipc.conf
    - cramfs.conf
    - freevxfs.conf
    - hfs.conf
    - hfsplus.conf
    - jffs2.conf
    - squashfs.conf
    - udf.conf

# --- Login banners ---
- name: Deploy login banners
  ansible.builtin.copy:
    src: "banners/{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: "0644"
    backup: true
  loop:
    - {src: issue, dest: /etc/issue}
    - {src: issue.net, dest: /etc/issue.net}
    - {src: motd, dest: /etc/motd}

# --- cron permissions ---
- name: Remove /etc/cron.deny if present
  ansible.builtin.file:
    path: /etc/cron.deny
    state: absent

- name: Ensure /etc/cron.allow exists with STIG permissions
  ansible.builtin.file:
    path: /etc/cron.allow
    state: touch
    owner: root
    group: root
    mode: "0600"
    access_time: preserve
    modification_time: preserve

- name: Harden cron system paths
  ansible.builtin.file:
    path: "{{ item.path }}"
    mode: "{{ item.mode }}"
    owner: root
    group: root
  loop:
    - {path: /etc/crontab, mode: "0600"}
    - {path: /etc/cron.hourly, mode: "0700"}
    - {path: /etc/cron.daily, mode: "0700"}
    - {path: /etc/cron.weekly, mode: "0700"}
    - {path: /etc/cron.monthly, mode: "0700"}
    - {path: /etc/cron.d, mode: "0700"}

# --- at permissions ---
- name: Remove /etc/at.deny if present
  ansible.builtin.file:
    path: /etc/at.deny
    state: absent

- name: Ensure /etc/at.allow exists with STIG permissions
  ansible.builtin.file:
    path: /etc/at.allow
    state: touch
    owner: root
    group: root
    mode: "0600"
    access_time: preserve
    modification_time: preserve