---
# Host baseline shared by both servers. Users, Docker itself and the
# first-boot packages come from terraform/cloud-init; SSH and WireGuard
# have their own bootstrap playbooks.

- name: Install baseline packages
  ansible.builtin.apt:
    name:
      - unattended-upgrades
      - fail2ban
    state: present

- name: Enable unattended security upgrades
  ansible.builtin.copy:
    src: 20auto-upgrades
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    mode: "0644"

- name: Keep fail2ban running (sshd jail from the Debian defaults)
  ansible.builtin.systemd:
    name: fail2ban
    enabled: true
    state: started

- name: Create journald drop-in directory
  ansible.builtin.file:
    path: /etc/systemd/journald.conf.d
    state: directory
    mode: "0755"

- name: Cap the journal size
  ansible.builtin.copy:
    dest: /etc/systemd/journald.conf.d/size.conf
    content: |
      [Journal]
      SystemMaxUse={{ journald_max_use }}
    mode: "0644"
  notify: Restart journald

- name: Configure the Docker daemon
  ansible.builtin.copy:
    src: daemon.json
    dest: /etc/docker/daemon.json
    mode: "0644"
  notify: Restart docker

# dockerd must only listen on its unix socket. A drop-in once added
# -H tcp://<vpc ip>:2375, which gave every container on the private
# network unauthenticated root on this host.
- name: Remove any Docker systemd override
  ansible.builtin.file:
    path: /etc/systemd/system/docker.service.d/override.conf
    state: absent
  notify: Restart docker

- name: Prune unused Docker images weekly
  ansible.builtin.copy:
    dest: /etc/cron.d/docker-image-prune
    content: |
      {{ docker_prune_schedule }} root docker image prune -af > /var/log/docker-prune.log 2>&1
    mode: "0644"