playbook.yml

- hosts: all
  become: true
  vars:
    username: 
    packages:
    - atop
    - screen

  tasks:
  - name: Setup passwordless sudo
    lineinfile:
      path: /etc/sudoers
      state: present
      regexp: '^%sudo'
      line: '%sudo ALL=(ALL) NOPASSWD: ALL'
      validate: '/usr/sbin/visudo -cf %s'

  - name: Create user with sudo
    user:
      name: "{{ username }}"
      state: present
      groups: sudo
      append: true
      create_home: true

  - name: Set authorised key for user
    ansible.posix.authorized_key:
      user: "{{ username }}"
      state: present
      key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"

  - name: Disable root auth
    lineinfile:
      path: /etc/ssh/sshd_config
      state: present
      regexp: '^~?PermitRootLogin'
      line: 'PermitRootLogin no'
      validate: sshd -t -f %s

  - name: Disable Password Authentication
    lineinfile:
      path: /etc/ssh/sshd_config
      state: present
      regexp: '^PasswordAuthentication'
      line: 'PasswordAuthentication no'

  - name: Update and upgrade packages
    apt:
      update_cache: yes
      upgrade: yes

  - name: Install packages
    apt:
      name: "{{ packages }}"
      state: latest
      update_cache: yes

  - name: Allow SSH connections through firewall
    ufw:
      rule: allow
      name: OpenSSH

  - name: Enable firewall and deny by default
    ufw:
      state: enabled
      default: deny

  - name: Set hostname
    hostname:
      name: "{{ inventory_hostname }}"