---
# handlers file for cis-security

# The auditd service has to be restarted with the actual SYS5 service
# command rather than the service module (which uses systemd)
# https://access.redhat.com/solutions/2664811

- name: Restart auditd
  ansible.builtin.command: service auditd restart
  when: ansible_os_family != "windows"
  listen: "Restart auditd"

# reboot a machine. Give it 10 minutes to come up in case it
#  needs to do a selinux relabel
- name: Reboot
  ansible.builtin.reboot:
#    reboot_timeout: 600

- name: Restart ntpd
  ansible.builtin.service:
    name: ntpd
    state: restarted

- name: Restart sshd
  ansible.builtin.service:
    name: sshd
    state: restarted

- name: Restart chronyd
  ansible.builtin.service:
    name: chronyd
    state: restarted

- name: Restart rsyslog
  ansible.builtin.service:
    name: rsyslog
    state: restarted

- name: Restart journald
  ansible.builtin.service:
    name: systemd-journald
    state: restarted

- name: Restart postfix
  ansible.builtin.service:
    name: postfix
    state: restarted

- name: Start firewalld
  ansible.builtin.service:
    name: firewalld
    state: started

- name: Restart firewalld
  ansible.builtin.service:
    name: firewalld
    state: restarted

- name: Start iptables
  ansible.builtin.service:
    name: iptables
    state: started

- name: Restart tmpfs
  ansible.builtin.systemd:
    name: tmp.mount
    state: restarted
    enabled: true
    masked: false
    daemon_reload: true

# Call the grub config file rebuilding program
# There is no grub module, so we have to do it with shell
- name: Rebuild grub
  ansible.builtin.command: /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg

# Call the grub config file rebuilding program on ubuntu
# There is no grub module, so we have to do it with shell
- name: Rebuild ubuntu-grub
  ansible.builtin.command: /usr/sbin/grub-mkconfig -o /boot/grub/grub.cfg

- name: Update crypto_policy
  ansible.builtin.command: /usr/bin/update-crypto-policies

- name: Restart aidecheck
  ansible.builtin.systemd:
    name: aidecheck
    enabled: true
    daemon_reload: true
    state: restarted

- name: Flush network routes
  ansible.posix.sysctl:
    name: "{{ item }}"
    value: "1"
    reload: true
    state: present
    sysctl_set: true
  loop:
    - net.ipv4.route.flush
    - net.ipv6.route.flush

- name: Restart timesyncd
  ansible.builtin.systemd:
    name: systemd.timesyncd
    enabled: true
    state: restarted

- name: Restart ufw
  community.general.ufw:
    state: enabled
