---
- name: Audit SSH daemon effective configuration
  ansible.builtin.command:
    argv:
      - sshd
      - -T
  register: baseline_sshd_effective
  changed_when: false
  failed_when: false

- name: Report SSH hardening observations without changing SSH
  ansible.builtin.debug:
    msg:
      permit_root_login: >-
        {{ baseline_sshd_effective.stdout_lines | select('match', '^permitrootlogin ') | list }}
      password_authentication: >-
        {{ baseline_sshd_effective.stdout_lines | select('match', '^passwordauthentication ') | list }}

- name: Audit time synchronization service state
  ansible.builtin.command:
    argv:
      - systemctl
      - is-active
      - systemd-timesyncd
  register: baseline_timesync_state
  changed_when: false
  failed_when: false

- name: Install baseline logrotate policy only with explicit opt-in
  ansible.builtin.copy:
    dest: /etc/logrotate.d/vps-baseline
    content: |
      /var/log/vps-health/*.log /var/log/vps-restic/*.log {
          weekly
          rotate 8
          missingok
          notifempty
          compress
          create 0640 root root
      }
    owner: root
    group: root
    mode: "0644"
  when: baseline_manage_logrotate | bool