---
- name: Configure systemd journald.conf
  become: true
  ansible.builtin.template:
    src: etc/systemd/journald.conf.j2
    dest: /etc/systemd/journald.conf
    backup: true
    mode: "0644"
    owner: root
    group: root
  notify:
    - Reload systemd
  tags:
    - systemd
    - journald
    - CIS-UBUNTU2004-4.2.2.1
    - CIS-UBUNTU2004-4.2.2.2
    - CIS-UBUNTU2004-4.2.2.3

- name: Configure logrotate(8)
  become: true
  ansible.builtin.template:
    src: etc/logrotate.conf.j2
    dest: /etc/logrotate.conf
    backup: true
    mode: "0644"
    owner: root
    group: root
  tags:
    - logrotate

- name: Configure cron.daily logrotate
  become: true
  ansible.builtin.lineinfile:
    line: "/usr/sbin/logrotate /etc/logrotate.conf"
    dest: /etc/cron.daily/logrotate
    mode: "0750"
    state: present
    create: true
  tags:
    - cron
    - logrotate

- name: Stat rsyslog.conf
  become: true
  ansible.builtin.stat:
    path: /etc/rsyslog.conf
  register: rsyslogconf
  tags:
    - rsyslog

- name: Stat rsyslog.conf FileCreateMode
  become: true
  environment:
    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  ansible.builtin.shell: grep "^$FileCreateMode" /etc/rsyslog.conf
  register: rsyslog_filecreatemode
  changed_when: false
  when: rsyslogconf.stat.exists
  tags:
    - rsyslog

- name: Configure rsyslog.conf FileCreateMode
  become: true
  ansible.builtin.lineinfile:
    regexp: '^\$FileCreateMode'
    line: "$FileCreateMode 0600"
    dest: /etc/rsyslog.conf
    mode: "0640"
    state: present
    create: false
  when: rsyslogconf.stat.exists and rsyslog_filecreatemode.stdout.find('FileCreateMode') != -1
  tags:
    - rsyslog
    - CIS-UBUNTU2004-4.2.1.4

- name: Add FileCreateMode file to the rsyslog.d directory
  become: true
  ansible.builtin.lineinfile:
    regexp: '^\$FileCreateMode'
    line: "$FileCreateMode 0600"
    dest: /etc/rsyslog.d/99-filecreatemode.conf
    mode: "0644"
    state: present
    create: true
  tags:
    - rsyslog