---
# restrict-ssh.yml
#
# Restricts SSH access on Ubuntu servers to a single IP range using UFW.
# Uses the community.general.ufw module.
#
# Usage:
#   ansible-playbook -i inventory.ini restrict-ssh.yml
#
# Override the range or port at runtime:
#   ansible-playbook -i inventory.ini restrict-ssh.yml -e "ssh_allowed_range=10.0.0.0/24 ssh_port=2222"

- name: Restrict SSH access to an allowed IP range
  hosts: ubuntu_servers
  become: true

  vars:
    ssh_allowed_range: "192.168.1.0/24"
    ssh_port: 22

  tasks:
    - name: Ensure UFW is installed
      ansible.builtin.apt:
        name: ufw
        state: present
        update_cache: true

    - name: Set default policy to deny incoming traffic
      community.general.ufw:
        direction: incoming
        policy: deny

    - name: Set default policy to allow outgoing traffic
      community.general.ufw:
        direction: outgoing
        policy: allow

    - name: Allow SSH only from the permitted range
      community.general.ufw:
        rule: allow
        from_ip: "{{ ssh_allowed_range }}"
        to_port: "{{ ssh_port }}"
        proto: tcp

    - name: Remove any rule allowing SSH from anywhere (by port)
      community.general.ufw:
        rule: allow
        to_port: "{{ ssh_port }}"
        proto: tcp
        delete: true

    - name: Remove any rule allowing the OpenSSH application profile from anywhere
      community.general.ufw:
        rule: allow
        name: OpenSSH
        delete: true

    - name: Enable UFW
      community.general.ufw:
        state: enabled