---
- name: Secure and Update Fedora 43 Server
  hosts: all
  become: true
  gather_facts: true
  
  vars:
    ansible_python_interpreter: /usr/bin/python3.14
  tasks:
    # Update system
    - name: Update all packages (safe upgrade)
      ansible.builtin.dnf:
        name: "*"
        state: latest
        update_cache: true

    - name: Install security tools
      ansible.builtin.dnf:
        name:
          - audit
          - fail2ban
          - dnf-automatic
        state: present


    - name: Configure dnf-automatic for security updates only
      ansible.builtin.template:
        src: automatic.conf.j2
        dest: /etc/dnf/automatic.conf


    - name: Ensure dnf-automatic timer is enabled
      ansible.builtin.systemd:
        name: dnf-automatic.timer
        state: started
        enabled: true

    # Ensure SELinux is enforcing
    - name: Ensure SELinux is in enforcing mode
      ansible.posix.selinux:
        policy: targeted
        state: enforcing

    # Enable and start fail2ban
    - name: Enable and start fail2ban
      ansible.builtin.service:
        name: fail2ban
        state: started
        enabled: true