---

- name: basic setup for all hosts
  hosts: all,!hetzner_storageboxes,!rsync_net
  remote_user: root
  roles:
    - { role: common }
    - { role: firewalld }
    - { role: wireguard }
    # reconfiguring sshd may break the AUR on luna (unchecked)
    # - { role: sshd, tags: ['sshd'] }
    - { role: root_ssh }
    - { role: borg_client, tags: ["borg"], when: "'borg_clients' in group_names" }
    - { role: hardening }
    - { role: fail2ban }
