---
- name: set Debian audit grub cmdline
  become: 'yes'
  ansible.builtin.lineinfile:
    line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX {{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"'
    dest: /etc/default/grub.d/99-hardening-audit.cfg
    state: present
    create: 'yes'
    mode: 0755
    owner: root
    group: root

- name: set audit action_mail_acct
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^action_mail_acct ="
    line: "action_mail_acct = {{ auditd_action_mail_acct }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit admin_space_left_action
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^admin_space_left_action = "
    line: "admin_space_left_action = {{ auditd_admin_space_left_action }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit disk_error_action
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^disk_error_action ="
    line: "disk_error_action = {{ auditd_disk_error_action }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit disk_full_action
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^disk_full_action ="
    line: "disk_full_action = {{ auditd_disk_full_action }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit max_log_file
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^max_log_file ="
    line: "max_log_file = {{ auditd_max_log_file }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit max_log_file_action
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^max_log_file_action ="
    line: "max_log_file_action = {{ auditd_max_log_file_action }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit num_logs
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^num_logs ="
    line: "num_logs = {{ auditd_num_logs }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit space_left
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^space_left ="
    line: "space_left = {{ auditd_space_left }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: set audit space_left_action
  become: 'yes'
  ansible.builtin.lineinfile:
    regexp: "^space_left_action ="
    line: "space_left_action = {{ auditd_space_left_action }}"
    dest: /etc/audit/auditd.conf
    mode: 0640
    state: present
    create: 'no'

- name: audit.rules
  become: 'yes'
  ansible.builtin.template:
    src: hardening.rules.j2
    dest: /etc/audit/rules.d/hardening.rules
    backup: 'yes'
    mode: 0600
    owner: root
    group: root
  when: auditd_apply_audit_rules|bool
  notify:
    - generate auditd
    - restart auditd
...