---
- name: Playbook de Segurança e Hardening Linux
  hosts: cloud
  become: true
  tasks:

    - name: Garantir que o serviço do Firewall esteja ativo e habilitado
      ansible.builtin.service:
        name: ufw
        state: started
        enabled: yes

    - name: Permitir tráfego SSH em porta customizada
      community.general.ufw:
        rule: allow
        port: '2222'
        proto: tcp

    - name: Desabilitar autenticação por senha no SSH
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present
      notify: Reiniciar SSH

  handlers:
    - name: Reiniciar SSH
      ansible.builtin.service:
        name: ssh
        state: restarted