---
- hosts: scummvm-general
  environment:
          LC_ALL: C
          LANG: C

  tasks:
        - name: Update repositories
          apt: update_cache=yes cache_valid_time=600

        - name: Upgrade packages
          apt: upgrade=yes
          register: apt_result

        - name: Remove obsolete packages
          command: apt autoremove -y
          register: apt_result
          changed_when: "'packages will be REMOVED' in apt_result.stdout"

        - name: Make sure all base packages for our setup are installed
          apt: 
                name: [qemu-guest-agent, lsof, strace, vnstat, sudo, git, vim, htop, fail2ban, iptraf-ng, whois, net-tools, unattended-upgrades, mc]
                update_cache: yes
                state: present

        - name: Disable PasswordAuthentication in sshd_config
          lineinfile: 
                path: /etc/ssh/sshd_config
                regexp: '^#?PasswordAuthentication(.*)$'
                line: PasswordAuthentication no
        
        - name: Enforce PermitRootLogin prohibit-password
          lineinfile:
                path: /etc/ssh/sshd_config
                regexp: '^#?PermitRootLogin(.*)$'
                line: PermitRootLogin prohibit-password
          notify: restart sshd

  handlers:
          - name: restart sshd
            service: name=ssh state=restarted
