---
- name: Harden host and install K3s
  hosts: k3s_servers
  become: true
  gather_facts: true

  vars:
    k3s_version: "v1.30.6+k3s1"
    k3s_install_url: "https://get.k3s.io"

  pre_tasks:
    - name: Require a supported Ubuntu release
      ansible.builtin.assert:
        that:
          - ansible_distribution == "Ubuntu"
          - ansible_distribution_version is version("22.04", ">=")
        fail_msg: "This playbook expects Ubuntu 22.04 or newer."

  tasks:
    - name: Install host security prerequisites
      ansible.builtin.apt:
        name:
          - apparmor
          - apparmor-utils
          - curl
          - ca-certificates
          - unattended-upgrades
        state: present
        update_cache: true

    - name: Ensure unattended security upgrades are enabled
      ansible.builtin.service:
        name: unattended-upgrades
        state: started
        enabled: true

    - name: Disable swap for Kubernetes node
      ansible.builtin.command: swapoff -a
      changed_when: false

    - name: Remove swap entries from fstab
      ansible.builtin.replace:
        path: /etc/fstab
        regexp: '^([^#].*\sswap\s+.*)$'
        replace: '# Disabled for Kubernetes: \1'

    - name: Set restrictive SSH password authentication
      ansible.builtin.copy:
        dest: /etc/ssh/sshd_config.d/60-k8s-baseline.conf
        owner: root
        group: root
        mode: '0644'
        content: |
          PasswordAuthentication no
          PermitRootLogin no
      notify: Restart ssh

    - name: Install pinned K3s server
      ansible.builtin.shell: |
        curl -sfL {{ k3s_install_url }} | INSTALL_K3S_VERSION={{ k3s_version }} sh -s - server --write-kubeconfig-mode 600
      args:
        creates: /usr/local/bin/k3s

    - name: Enable and start K3s
      ansible.builtin.service:
        name: k3s
        state: started
        enabled: true

  handlers:
    - name: Restart ssh
      ansible.builtin.service:
        name: ssh
        state: restarted