---
- name: Set hostname
  ansible.builtin.hostname:
    name: "{{ base_hostname }}"
  tags: [base, hostname]

- name: Configure hosts file
  ansible.builtin.template:
    src: hosts.j2
    dest: /etc/hosts
    owner: root
    group: root
    mode: "0644"
  tags: [base, hostname]

- name: Install base packages
  ansible.builtin.apt:
    name: "{{ base_packages }}"
    state: present
    update_cache: true
    cache_valid_time: 3600
  tags: [base, packages]

- name: Configure locale
  community.general.locale_gen:
    name: "{{ base_locale }}"
    state: present
  tags: [base, locale]

- name: Set system locale
  ansible.builtin.copy:
    dest: /etc/default/locale
    owner: root
    group: root
    mode: "0644"
    content: |
      LANG={{ base_locale }}
      LC_ALL={{ base_locale }}
  tags: [base, locale]

- name: Configure timezone
  community.general.timezone:
    name: "{{ base_timezone }}"
  notify: restart chrony
  tags: [base, timezone]

- name: Ensure standard directories exist
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "{{ '0700' if item.endswith('/private') else '0755' }}"
  loop: "{{ base_standard_directories }}"
  tags: [base, directories]

- name: Configure persistent journald storage
  ansible.builtin.copy:
    dest: /etc/systemd/journald.conf.d/10-nbops.conf
    owner: root
    group: root
    mode: "0644"
    content: |
      [Journal]
      Storage=persistent
      Compress=yes
      SystemMaxUse=1G
  notify: restart systemd-journald
  tags: [base, journald]

- name: Configure sysctl
  ansible.posix.sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
    state: present
    reload: true
  loop: "{{ base_sysctl | dict2items }}"
  tags: [base, sysctl]

- name: Configure shell aliases
  ansible.builtin.template:
    src: nbops-aliases.sh.j2
    dest: /etc/profile.d/nbops-aliases.sh
    owner: root
    group: root
    mode: "0644"
  tags: [base, shell]

- name: Enable base services
  ansible.builtin.service:
    name: "{{ item }}"
    enabled: true
    state: started
  loop:
    - chrony
    - qemu-guest-agent
  tags: [base, services]

- name: Refresh CA certificate trust
  ansible.builtin.command:
    cmd: update-ca-certificates
  changed_when: false
  tags: [base, pki]