roswaal/roles/immortal/tasks/main.yml

---
- name: Generate password
  delegate_to: localhost
  shell: bash autopassword.sh {{ inventory_hostname }}
  register: genPass 
    
- name: Backup ssh config
  fetch:
    src: /etc/ssh/sshd_config
    dest: "{{ inventory_hostname }}" 
  become: yes 

- name: Backup os-release
  fetch:
    src: /etc/os-release
    dest: "{{ inventory_hostname }}"  

- name: Backup etc/passwd
  fetch:
    src: /etc/passwd
    dest: "{{ inventory_hostname }}"

- name: Get users
  get_users:
    #min_uid: "{{ (ansible_os_family == 'RedHat') | ternary(500,1000) }}"
    min_uid: 1000
    max_uid: 65000
  register: users_list

- name: Give root exclusively the current controller user's SSH key
  ansible.posix.authorized_key:
    user: root
    state: present
    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
    exclusive: yes
  become: yes


- name: Give all users exclusively the current controller user's SSH key
  ansible.posix.authorized_key:
    user: "{{item}}"
    state: present
    key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
    exclusive: yes
  become: yes
  loop: "{{ users_list.users }}"

- block:
    - name: Ensure UFW is installed
      package:
        name: ufw
        state: present

    - name: Configure ufw defaults
      ufw: direction={{ item.direction }} policy={{ item.policy }}
      with_items:
        - { direction: 'incoming', policy: 'deny' }
        - { direction: 'outgoing', policy: 'allow' }
      notify:
        - restart ufw

    - name: Configure ufw rules
      ufw: rule={{ item.rule }} port={{ item.port }} proto={{ item.proto }}
      with_items:
        - { rule: 'limit', port: '22', proto: 'tcp' }
      notify:
        - restart ufw

    - name: Enable ufw logging
      ufw: logging=on
      notify:
        - restart ufw

    - name: Enable ufw
      ufw: state=enabled
    
    - name: Change root password
      user:
        name: root
        shell: /bin/bash
        password: "{{ genPass.stdout | password_hash('sha512') }}"

    - name: Change admin password
      user:
        name: "{{ ansible_user }}"
        shell: /bin/bash
        password: "{{ genPass.stdout | password_hash('sha512') }}"         
  become: yes