---
- name: Upgrade all packages
  apt:
    update_cache: true
    upgrade: dist
    cache_valid_time: 3600

- name: Install base packages
  apt:
    name:
      - curl
      - git
      - ufw
      - fail2ban
      - unattended-upgrades
      - ca-certificates
    state: present

- name: Configure ufw — allow SSH
  ufw:
    rule: allow
    name: OpenSSH

- name: Configure ufw — allow HTTP
  ufw:
    rule: allow
    port: "80"
    proto: tcp

- name: Configure ufw — allow HTTPS
  ufw:
    rule: allow
    port: "443"
    proto: tcp

- name: Enable ufw
  ufw:
    state: enabled
    policy: deny

- name: Enable unattended-upgrades
  service:
    name: unattended-upgrades
    enabled: true
    state: started