---
# System configuration tasks

# SSH host key regeneration for cloned VMs
# Only runs once per host (marker file prevents re-running)
- name: Check if SSH host keys have been regenerated
  ansible.builtin.stat:
    path: /etc/ssh/.host_keys_regenerated
  register: ssh_keys_marker

- name: Regenerate SSH host keys (first boot after clone)
  when: not ssh_keys_marker.stat.exists
  block:
    - name: Remove existing SSH host keys
      ansible.builtin.file:
        path: "{{ item }}"
        state: absent
      loop:
        - /etc/ssh/ssh_host_rsa_key
        - /etc/ssh/ssh_host_rsa_key.pub
        - /etc/ssh/ssh_host_ecdsa_key
        - /etc/ssh/ssh_host_ecdsa_key.pub
        - /etc/ssh/ssh_host_ed25519_key
        - /etc/ssh/ssh_host_ed25519_key.pub
        - /etc/ssh/ssh_host_dsa_key
        - /etc/ssh/ssh_host_dsa_key.pub

    - name: Regenerate SSH host keys
      ansible.builtin.command:
      args:
        creates: /etc/ssh/ssh_host_ed25519_key
      when: ansible_facts['os_family'] == "Debian"
      notify: restart ssh

    - name: Regenerate SSH host keys (RHEL)
      ansible.builtin.shell:
        ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
        ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
        ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
      args:
        creates: /etc/ssh/ssh_host_ed25519_key
      when: ansible_facts['os_family'] == "RedHat"
      notify: restart ssh

    - name: Regenerate SSH host keys (Alpine)
      ansible.builtin.shell:
        ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
        ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
        ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
      args:
        creates: /etc/ssh/ssh_host_ed25519_key
      when: ansible_facts['os_family'] == "Alpine"
      notify: restart ssh

    - name: Create marker file to prevent re-running
      ansible.builtin.file:
        path: /etc/ssh/.host_keys_regenerated
        state: touch
        mode: '0644'

- name: Install SSH banner
  ansible.builtin.template:
    src: issue.net.j2
    dest: /etc/issue.net
    mode: '0644'
  tags:
    - ssh

- name: Configure SSH to use banner
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^Banner'
    line: 'Banner /etc/issue.net'
    state: present
  notify: restart ssh
  tags:
    - ssh

# Uncomment if you want to disable root SSH access
# - name: Disallow root SSH access
#   lineinfile:
#     path: /etc/ssh/sshd_config
#     regexp: "^PermitRootLogin"
#     line: "PermitRootLogin no"
#     state: present
#   notify: restart ssh
#   tags:
#     - ssh