debian.yml

---
- hosts: all
  tasks:

  - name: reduce grub timeout when booting
    register: grub
    lineinfile:
      path: /etc/default/grub
      regexp: "^GRUB_TIMEOUT="
      line: "GRUB_TIMEOUT=1"

  - name: update grub bootloader
    when: grub.changed
    shell: "/usr/sbin/grub-mkconfig -o /boot/grub/grub.cfg"

  - name: disable sshd banner
    register: sshd_banner
    file:
      dest: /etc/update-motd.d/10-uname
      mode: a-x

  - name: disable sshd motd
    register: sshd_motd
    copy:
      content: ""
      dest: /etc/motd

  - name: configure sshd_config
    register: sshd_config
    copy:
      dest: /etc/ssh/sshd_config
      validate: /usr/sbin/sshd -T -f %s
      content: |
        Include /etc/ssh/sshd_config.d/*.conf
        ChallengeResponseAuthentication no
        UsePAM yes
        X11Forwarding no
        PrintMotd no
        AcceptEnv LANG LC_*
        Subsystem sftp /usr/lib/openssh/sftp-server
        PasswordAuthentication no
        PrintLastLog no

  - name: restart sshd
    when: sshd_banner.changed or sshd_motd.changed or sshd_config.changed
    service:
      name: ssh
      state: restarted

  - name: remove hetzner apt repositories
    file:
      path: "{{ item }}"
      state: absent
    with_items:
      - /etc/apt/sources.list.d/hetzner-mirror.list
      - /etc/apt/sources.list.d/hetzner-security-updates.list

  - name: setup apt main apt repositories
    copy:
      content: "deb http://deb.debian.org/debian/ bullseye main\ndeb http://deb.debian.org/debian/ bullseye-updates main\ndeb http://security.debian.org/debian-security bullseye-security main"
      dest: /etc/apt/sources.list

  - name: update packages
    apt:
      name: "*"
      state: latest
      update_cache: yes

  - name: uninstall cryptsetup
    apt:
      name: cryptsetup
      state: absent
      autoremove: yes
      purge: yes

  - name: install ansible dependencies and base packages
    apt:
      name:
        - sudo
        - zip
        - unzip
        - man
        - curl
        - wget
        - gnupg
        - htop
        - net-tools
        - python3-apt
        - apt-transport-https
        - open-vm-tools
        - unattended-upgrades
      state: present

  - name: configure unattended upgrades
    copy:
      content: "Unattended-Upgrade::Origins-Pattern {\n  \"origin=Debian,codename=${distro_codename}-security,label=Debian-Security\";\n};\n  Unattended-Upgrade::Package-Blacklist {\n};"
      dest: /etc/apt/apt.conf.d/50unattended-upgrades

  - name: enable unattended upgrades
    copy:
      content: "APT::Periodic::Enable \"1\";\nAPT::Periodic::Update-Package-Lists \"1\";\nAPT::Periodic::Download-Upgradeable-Packages \"1\";\nAPT::Periodic::Unattended-Upgrade \"1\";\nAPT::Periodic::AutocleanInterval \"7\";"
      dest: /etc/apt/apt.conf.d/02periodic

  - name: set ntp server
    register: ntp_server
    copy:
      content: "[Time]\nNTP=time.google.com"
      dest: /etc/systemd/timesyncd.conf

  - name: restart systemd-timesyncd
    when: ntp_server.changed
    service:
      name: systemd-timesyncd
      state: restarted
      enabled: yes

  - name: check if swapfile is created
    stat:
      path: /swapfile
    register: swap

  - name: create swapfile
    command: fallocate -l 1536M /swapfile
    when: swap.stat.exists == False

  - name: set permissions for swapfile
    file:
      dest: /swapfile
      mode: 0600
    when: swap.stat.exists == False

  - name: setup swapfile partition
    command: mkswap /swapfile
    when: swap.stat.exists == False

  - name: enable swapfile
    command: swapon /swapfile
    when: swap.stat.exists == False

  - name: add swapfile to /etc/fstab
    mount:
      src: /swapfile
      name: "none"
      fstype: "swap"
      opts: "sw,nofail"
      dump: "0"
      passno: "0"
      state: present
    when: swap.stat.exists == False