name: Weekly Reconciliation

on:
  schedule:
    - cron: "0 2 * * 0"

jobs:
  ansible-apply:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup environment
        uses: ./.github/actions/setup-env

      - name: Setup Ansible environment
        uses: ./.github/actions/setup-ansible-env
        with:
          vault-master-password: ${{ secrets.VAULT_MASTER_PASSWORD }}
          ansible-user: ${{ secrets.ANSIBLE_USER }}
          trusted-hosts: ${{ secrets.TRUSTED_HOSTS }}

      - name: Apply Hardening Playbook
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
        run: |
          cd ansible
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_login.yml
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml
          sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml