---
# Security hardening — UFW firewall + fail2ban
- name: Install security packages
  apt:
    name:
      - ufw
      - fail2ban
    state: present

- name: Set UFW default deny incoming
  community.general.ufw:
    direction: incoming
    default: deny

- name: Set UFW default allow outgoing
  community.general.ufw:
    direction: outgoing
    default: allow

- name: Allow SSH through UFW
  community.general.ufw:
    rule: allow
    port: "22"
    proto: tcp

- name: Allow HTTP through UFW
  community.general.ufw:
    rule: allow
    port: "80"
    proto: tcp

- name: Allow HTTPS through UFW
  community.general.ufw:
    rule: allow
    port: "443"
    proto: tcp

- name: Enable UFW
  community.general.ufw:
    state: enabled

- name: Enable and start fail2ban
  systemd:
    name: fail2ban
    enabled: true
    state: started