---
- name: Debian Server Hardening
  hosts: debian_servers
  remote_user: bhays
  become: true
  become_user: root
  vars_files:
    - ../homelab-vault/secrets.yml
  pre_tasks:
    - name: Update apt cache if needed.
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 3600
  tasks:
    - name: Cloudflare DDNS Cronjob
      ansible.builtin.import_tasks: ../roles/cloudflare-dns.yml
    - name: Heartbeat Cronjob for Betterstack
      ansible.builtin.import_tasks: ../roles/heartbeat.yml
    - name: OpenSSH Hardening
      ansible.builtin.import_tasks: ../roles/openssh.yml
    - name: Generic Debian Hardening
      ansible.builtin.import_tasks: ../roles/debian.yml