---
- name: "Provision OpenSCAP Toolset in Air-Gapped Fleet (Pre-Flight)"
  hosts: fleet
  gather_facts: true
  become: true

  vars:
    controller_tools_archive: "/home/operator/openscap-tools-rhel-airgap.tar.gz"
    target_tools_dir: "/var/tmp/openscap_offline_tools"

  tasks:
    - name: "0.1 Create target staging directory"
      ansible.builtin.file:
        path: "{{ target_tools_dir }}"
        state: directory
        mode: "0755"

    - name: "0.2 Transfer and extract tools bundle to target host"
      ansible.builtin.unarchive:
        src: "{{ controller_tools_archive }}"
        dest: "{{ target_tools_dir }}"
        mode: "0755"

    - name: "0.3 Configure local DNF repo definition (RHEL family)"
      ansible.builtin.copy:
        dest: "/etc/yum.repos.d/openscap-local.repo"
        content: |
          [openscap-local]
          name=Local OpenSCAP Tools Offline Repository
          baseurl=file://{{ target_tools_dir }}/packages
          enabled=1
          gpgcheck=1
          gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
        mode: "0644"
      when: ansible_os_family == 'RedHat'

    - name: "0.4 Execute pre-flight dry-run check (tsflags=test)"
      ansible.builtin.command:
        cmd: >
          dnf install -y
          --setopt=tsflags=test
          --disablerepo=*
          --enablerepo=openscap-local
          openscap-scanner scap-security-guide
      register: tool_dry_run
      changed_when: false
      when: ansible_os_family == 'RedHat'

    - name: "0.5 Install OpenSCAP scanner and security guide"
      ansible.builtin.dnf:
        name:
          - openscap-scanner
          - scap-security-guide
        state: present
        disablerepo: "*"
        enablerepo: "openscap-local"
        disable_plugin: "subscription-manager"
      when: ansible_os_family == 'RedHat'

    - name: "0.6 Verify oscap executable presence"
      ansible.builtin.command:
        cmd: "oscap --version"
      register: oscap_ver
      changed_when: false
      when: ansible_os_family == 'RedHat'

    - name: "0.7 Display installed OpenSCAP version"
      ansible.builtin.debug:
        msg: "Host {{ inventory_hostname }}: {{ oscap_ver.stdout_lines[0] }}"
      when: ansible_os_family == 'RedHat'

---
- name: "Enterprise OpenSCAP OVAL Fleet Vulnerability Audit (Part A1)"
  hosts: fleet,controllers
  gather_facts: true
  become: false

  vars:
    target_staging_dir: "/var/tmp/openscap_oval"
    target_report_html: "/var/tmp/openscap_oval/oval-report-{{ inventory_hostname }}.html"
    target_results_xml: "/var/tmp/openscap_oval/oval-results-{{ inventory_hostname }}.xml"
    controller_harvest_dir: "/home/operator/audit-reports/oval/{{ inventory_hostname }}"

  tasks:
    - name: "1.1 Determine host-specific OVAL definition feed"
      ansible.builtin.set_fact:
        host_oval_filename: >-
          {%- if ansible_os_family == 'RedHat' and ansible_distribution_major_version == '8' -%}
          rhel-8.oval.xml
          {%- elif ansible_os_family == 'RedHat' and ansible_distribution_major_version == '9' -%}
          rhel-9.oval.xml
          {%- elif ansible_os_family == 'RedHat' and ansible_distribution_major_version == '10' -%}
          rhel-10.oval.xml
          {%- elif ansible_distribution | lower == 'ubuntu' -%}
          com.ubuntu.{{ ansible_distribution_release }}.usn.oval.xml
          {%- elif ansible_distribution | lower == 'debian' and ansible_distribution_major_version == '11' -%}
          oval-definitions-bullseye.xml
          {%- elif ansible_distribution | lower == 'debian' and ansible_distribution_major_version == '12' -%}
          oval-definitions-bookworm.xml
          {%- else -%}
          unsupported
          {%- endif -%}

    - name: "1.2 Fail if OVAL definition feed is unsupported for target host OS"
      ansible.builtin.fail:
        msg: "OVAL feed unavailable for {{ ansible_distribution }} {{ ansible_distribution_version }}"
      when: host_oval_filename == 'unsupported'

    - name: "1.3 Set target OVAL stream path"
      ansible.builtin.set_fact:
        controller_oval_stream: "/home/operator/openscap_oval/{{ host_oval_filename }}"
        target_oval_stream: "{{ target_staging_dir }}/{{ host_oval_filename }}"

    - name: "1.4 Verify openscap-scanner is installed"
      ansible.builtin.command:
        cmd: "which oscap"
      register: oscap_check
      changed_when: false
      failed_when: oscap_check.rc != 0

    - name: "1.4 Create staging and harvest directories"
      ansible.builtin.file:
        path: "{{ item }}"
        state: directory
        mode: "0755"
      loop:
        - "{{ target_staging_dir }}"

    - name: "1.5 Create local controller harvest directory"
      ansible.builtin.file:
        path: "{{ controller_harvest_dir }}"
        state: directory
        mode: "0755"
      delegate_to: localhost

    - name: "2.1 Distribute target OS-specific OVAL stream to target host"
      ansible.builtin.copy:
        src: "{{ controller_oval_stream }}"
        dest: "{{ target_oval_stream }}"
        mode: "0644"
      when: inventory_hostname != 'mgmt-ctrl-01.infra.example.com'

    - name: "3.1 Execute OpenSCAP OVAL evaluation scan"
      ansible.builtin.command:
        cmd: >
          oscap oval eval
          --results {{ target_results_xml }}
          --report {{ target_report_html }}
          {{ target_oval_stream }}
      register: oscap_eval_raw
      changed_when: false
      failed_when: oscap_eval_raw.rc not in [0, 2]

    - name: "4.1 Fetch HTML report to controller"
      ansible.builtin.fetch:
        src: "{{ target_report_html }}"
        dest: "{{ controller_harvest_dir }}/oval-report.html"
        flat: true

    - name: "5.1 Extract compliance metrics from HTML report"
      ansible.builtin.shell: |
        bash -c "
        VULN=\$(grep -oP 'title=\"Non-Compliant/Vulnerable/Unpatched\" style=\"width:20%\">\K[0-9]+' {{ target_report_html }} | head -n 1)
        PASS=\$(grep -oP 'title=\"Compliant/Non-Vulnerable/Patched\" style=\"width:20%\">\K[0-9]+' {{ target_report_html }} | head -n 1)
        TOTAL=\$(grep -oP '[0-9]+ Total' {{ target_report_html }} | head -n 1 | awk '{print \$1}')
        echo \"TOTAL:\${TOTAL:-0} | VULN:\${VULN:-0} | PASS:\${PASS:-0}\"
        "
      register: oval_summary
      changed_when: false

    - name: "5.2 Display OVAL Assessment Scorecard"
      ansible.builtin.debug:
        msg:
          - "=================================================================="
          - "HOST: {{ inventory_hostname }} ({{ ansible_default_ipv4.address }})"
          - "RUNNING KERNEL: {{ ansible_kernel }}"
          - "OVAL EVALUATION: {{ oval_summary.stdout }}"
          - "REPORTS STAGED AT: {{ controller_harvest_dir }}/"
          - "=================================================================="

---
- name: "Enterprise OVAL Errata Fleet Remediation (Part A2)"
  hosts: fleet
  serial: 1
  gather_facts: true
  become: true

  vars:
    controller_repo_bundle: "/home/operator/internal-security-errata-rhel.tar.gz"
    target_repo_dir: "/var/tmp/offline-repos"
    target_oval_stream: "/var/tmp/openscap_oval/rhel-8.oval.xml"

  tasks:
    - name: "1.1 Create target offline repo directory"
      ansible.builtin.file:
        path: "{{ target_repo_dir }}"
        state: directory
        mode: "0755"

    - name: "1.2 Extract repository archive on target host"
      ansible.builtin.unarchive:
        src: "{{ controller_repo_bundle }}"
        dest: "{{ target_repo_dir }}"
        mode: "0755"

    - name: "1.3 Deploy internal repository configuration"
      ansible.builtin.copy:
        dest: "/etc/yum.repos.d/internal-security-errata.repo"
        content: |
          [internal-security-errata]
          name=Internal Air-Gapped Security Errata
          baseurl=file://{{ target_repo_dir }}/packages
          enabled=1
          gpgcheck=1
          gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
        mode: "0644"
      when: ansible_os_family == 'RedHat'

    - name: "2.1 Execute mandatory pre-flight dry-run simulation (tsflags=test)"
      ansible.builtin.command:
        cmd: >
          dnf upgrade -y
          --setopt=tsflags=test
          --disablerepo=*
          --enablerepo=internal-security-errata
          --disableplugin=subscription-manager
          --setopt=clean_requirements_on_remove=0
          --nobest
      register: dnf_dry_run
      changed_when: false
      when: ansible_os_family == 'RedHat'

    - name: "2.2 Assert 0 package removals during dry-run"
      ansible.builtin.assert:
        that:
          - "'Removing:' not in dnf_dry_run.stdout"
        fail_msg: "ABORT: DNF dry-run indicated package removals!"
      when: ansible_os_family == 'RedHat'

    - name: "3.1 Execute live package security upgrade"
      ansible.builtin.dnf:
        name: "*"
        state: latest
        disablerepo: "*"
        enablerepo: "internal-security-errata"
        disable_plugin: "subscription-manager"
        nobest: true
      when: ansible_os_family == 'RedHat'

    - name: "4.1 Post-remediation OpenSCAP OVAL evaluation"
      ansible.builtin.command:
        cmd: >
          oscap oval eval
          --results /var/tmp/openscap_oval/oval-results-post.xml
          --report /var/tmp/openscap_oval/oval-report-post.html
          {{ target_oval_stream }}
      register: oscap_post_eval
      changed_when: false
      failed_when: oscap_post_eval.rc not in [0, 2]

---
- name: "Enterprise OpenSCAP XCCDF Baseline Compliance Audit (Part B1)"
  hosts: fleet
  gather_facts: true
  become: false

  vars:
    target_report_html: "/var/tmp/openscap_xccdf/xccdf-report-{{ inventory_hostname }}.html"
    target_results_xml: "/var/tmp/openscap_xccdf/xccdf-results-{{ inventory_hostname }}.xml"
    controller_harvest_dir: "/home/operator/audit-reports/xccdf/{{ inventory_hostname }}"

  tasks:
    - name: "1.0 Dynamically select SCAP DataStream and Profile per host OS"
      ansible.builtin.set_fact:
        scap_datastream: >-
          {%- if ansible_distribution | lower in ['rocky', 'almalinux', 'centos', 'redhat', 'oraclelinux', 'ol'] -%}
          /usr/share/xml/scap/ssg/content/ssg-rhel{{ ansible_distribution_major_version }}-ds.xml
          {%- elif ansible_distribution | lower in ['opensuse', 'sles', 'sled', 'suse'] -%}
          /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml
          {%- elif ansible_distribution | lower == 'ubuntu' and ansible_distribution_version in ['22.04', '24.04'] -%}
          /usr/share/xml/scap/ssg/content/ssg-ubuntu{{ ansible_distribution_version | replace('.', '') }}-ds.xml
          {%- elif ansible_distribution | lower == 'ubuntu' and ansible_distribution_version == '26.04' -%}
          /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
          {%- elif ansible_distribution | lower == 'debian' and ansible_distribution_major_version in ['11', '12'] -%}
          /usr/share/xml/scap/ssg/content/ssg-debian{{ ansible_distribution_major_version }}-ds.xml
          {%- elif ansible_distribution | lower == 'debian' and ansible_distribution_major_version == '13' -%}
          /usr/share/xml/scap/ssg/content/ssg-debian12-ds.xml
          {%- else -%}
          unsupported
          {%- endif -%}
        scap_profile: >-
          {%- if ansible_distribution | lower == 'ubuntu' -%}
          xccdf_org.ssgproject.content_profile_cis_level2_server
          {%- elif ansible_distribution | lower == 'debian' -%}
          xccdf_org.ssgproject.content_profile_standard
          {%- else -%}
          xccdf_org.ssgproject.content_profile_cis
          {%- endif -%}

    - name: "1.0b Fail if SCAP DataStream is unsupported for target host OS"
      ansible.builtin.fail:
        msg: "SCAP DataStream unsupported for {{ ansible_distribution }} {{ ansible_distribution_version }}"
      when: scap_datastream == 'unsupported'

    - name: "1.1 Create target and controller directories"
      ansible.builtin.file:
        path: "/var/tmp/openscap_xccdf"
        state: directory
        mode: "0755"

    - name: "1.2 Create controller harvest directory"
      ansible.builtin.file:
        path: "{{ controller_harvest_dir }}"
        state: directory
        mode: "0755"
      delegate_to: localhost

    - name: "2.1 Execute OpenSCAP XCCDF compliance scan"
      ansible.builtin.command:
        cmd: >
          oscap xccdf eval
          --profile {{ scap_profile }}
          --results {{ target_results_xml }}
          --report {{ target_report_html }}
          {{ scap_datastream }}
      register: xccdf_eval_raw
      changed_when: false
      failed_when: xccdf_eval_raw.rc not in [0, 2]

    - name: "3.1 Fetch HTML and XML reports to controller"
      ansible.builtin.fetch:
        src: "{{ item.src }}"
        dest: "{{ item.dest }}"
        flat: true
      loop:
        - { src: "{{ target_report_html }}", dest: "{{ controller_harvest_dir }}/xccdf-report.html" }
        - { src: "{{ target_results_xml }}", dest: "{{ controller_harvest_dir }}/xccdf-results.xml" }

    - name: "4.1 Extract compliance score"
      ansible.builtin.shell: |
        grep -oP '<score[^>]*>\K[0-9.]+' {{ target_results_xml }} | head -n 1
      register: compliance_score
      changed_when: false

    - name: "4.2 Display Compliance Scorecard"
      ansible.builtin.debug:
        msg:
          - "=================================================================="
          - "HOST: {{ inventory_hostname }} ({{ ansible_default_ipv4.address }})"
          - "PROFILE: {{ scap_profile }}"
          - "COMPLIANCE SCORE: {{ compliance_score.stdout | default('N/A') }}%"
          - "REPORT: {{ controller_harvest_dir }}/xccdf-report.html"
          - "=================================================================="

---
- name: "Enterprise Safeguarded Baseline Remediation (Part B2)"
  hosts: fleet
  serial: 1
  gather_facts: true
  become: true

  vars:
    tailoring_file_src: "files/tailoring.xml"
    tailoring_file_dest: "/etc/security/scap-tailoring.xml"

  tasks:
    - name: "1.0 Dynamically select SCAP DataStream and Safe Profile per host OS"
      ansible.builtin.set_fact:
        scap_datastream: >-
          {%- if ansible_distribution | lower in ['rocky', 'almalinux', 'centos', 'redhat', 'oraclelinux', 'ol'] -%}
          /usr/share/xml/scap/ssg/content/ssg-rhel{{ ansible_distribution_major_version }}-ds.xml
          {%- elif ansible_distribution | lower in ['opensuse', 'sles', 'sled', 'suse'] -%}
          /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml
          {%- elif ansible_distribution | lower == 'ubuntu' and ansible_distribution_version in ['22.04', '24.04'] -%}
          /usr/share/xml/scap/ssg/content/ssg-ubuntu{{ ansible_distribution_version | replace('.', '') }}-ds.xml
          {%- elif ansible_distribution | lower == 'ubuntu' and ansible_distribution_version == '26.04' -%}
          /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
          {%- elif ansible_distribution | lower == 'debian' and ansible_distribution_major_version in ['11', '12'] -%}
          /usr/share/xml/scap/ssg/content/ssg-debian{{ ansible_distribution_major_version }}-ds.xml
          {%- elif ansible_distribution | lower == 'debian' and ansible_distribution_major_version == '13' -%}
          /usr/share/xml/scap/ssg/content/ssg-debian12-ds.xml
          {%- else -%}
          unsupported
          {%- endif -%}
        safe_profile: >-
          {%- if ansible_distribution | lower == 'debian' -%}
          xccdf_org.ssgproject.content_profile_standard_custom_safe
          {%- else -%}
          xccdf_org.ssgproject.content_profile_cis_custom_safe
          {%- endif -%}

    - name: "1.0b Fail if SCAP DataStream is unsupported for target host OS"
      ansible.builtin.fail:
        msg: "SCAP DataStream unsupported for {{ ansible_distribution }} {{ ansible_distribution_version }}"
      when: scap_datastream == 'unsupported'

    # -------------------------------------------------------------------------
    # 1. PRE-FLIGHT SUBSYSTEM HEALTH CHECK (ENFORCING ASSERTIONS)
    # -------------------------------------------------------------------------
    - name: "1.1 Assert core message engine daemon is running prior to remediation"
      ansible.builtin.command:
        cmd: "pgrep -a dispatchd"
      register: msg_proc
      changed_when: false
      failed_when: msg_proc.rc != 0
      when: "'core-msg' in inventory_hostname"

    - name: "1.2 Assert container manager is active prior to remediation"
      ansible.builtin.command:
        cmd: "podman ps -q"
      register: container_proc
      changed_when: false
      failed_when: container_proc.rc != 0
      when: "'svc-container' in inventory_hostname"

    # -------------------------------------------------------------------------
    # 2. DEPLOY AND VALIDATE TAILORED PROFILE
    # -------------------------------------------------------------------------
    - name: "2.1 Deploy verified SCAP tailoring XML"
      ansible.builtin.copy:
        src: "{{ tailoring_file_src }}"
        dest: "{{ tailoring_file_dest }}"
        mode: "0644"

    - name: "2.2 Validate tailoring file structure prior to remediation"
      ansible.builtin.command:
        cmd: "oscap info {{ tailoring_file_dest }}"
      register: tailoring_val
      changed_when: false

    - name: "2.3 Validate SCAP DataStream content prior to remediation"
      ansible.builtin.command:
        cmd: "oscap info {{ scap_datastream }}"
      register: datastream_val
      changed_when: false

    # -------------------------------------------------------------------------
    # 3. EXECUTE SAFE TAILORED REMEDIATION
    # -------------------------------------------------------------------------
    - name: "3.1 Execute OpenSCAP tailored remediation"
      ansible.builtin.command:
        cmd: >
          oscap xccdf eval
          --tailoring-file {{ tailoring_file_dest }}
          --profile {{ safe_profile }}
          --remediate
          --results /var/tmp/openscap_xccdf/xccdf-results-remediated.xml
          --report /var/tmp/openscap_xccdf/xccdf-report-remediated.html
          {{ scap_datastream }}
      register: rem_out
      changed_when: true
      failed_when: rem_out.rc not in [0, 2]

    # -------------------------------------------------------------------------
    # 4. POST-REMEDIATION INVARIANT ASSERTIONS
    # -------------------------------------------------------------------------
    - name: "4.1 CRITICAL ASSERTION: Verify SCTP module remains loadable"
      ansible.builtin.command:
        cmd: "modprobe -n -v sctp"
      register: sctp_mod
      changed_when: false
      failed_when: "'install /bin/true' in sctp_mod.stdout or sctp_mod.rc != 0"

    - name: "4.2 CRITICAL ASSERTION: Verify IP forward enabled on container node"
      ansible.builtin.command:
        cmd: "sysctl -n net.ipv4.ip_forward"
      register: ip_fwd
      changed_when: false
      failed_when: ip_fwd.stdout.strip() != '1'
      when: "'svc-container' in inventory_hostname"

    # -------------------------------------------------------------------------
    # 5. HARVEST POST-REMEDIATION SCORECARD
    # -------------------------------------------------------------------------
    - name: "5.1 Extract post-remediation compliance score"
      ansible.builtin.shell: |
        grep -oP '<score[^>]*>\K[0-9.]+' /var/tmp/openscap_xccdf/xccdf-results-remediated.xml | head -n 1
      register: post_score
      changed_when: false

    - name: "5.2 Display Remediation Completion Report"
      ansible.builtin.debug:
        msg:
          - "=================================================================="
          - "HOST: {{ inventory_hostname }}"
          - "STATUS: SAFEGUARDED REMEDIATION COMPLETED"
          - "NEW COMPLIANCE SCORE: {{ post_score.stdout | default('N/A') }}%"
          - "SUBSYSTEM HEALTH: ALL APPLICATION INVARIANTS SATISFIED"
          - "=================================================================="