---
- name: Configure firewall and SSH port
  block:
    - name: Fail if vmid is not defined
      ansible.builtin.fail:
        msg: "'vmid' must be defined to calculate dynamic SSH port"
      when: vmid is not defined

    - name: Calculate SSH port from vmid
      ansible.builtin.set_fact:
        ssh_port: "{{ 10000 + (vmid | int % 100) }}"

    - name: Enable and start firewalld
      ansible.builtin.service:
        name: firewalld
        state: started
        enabled: true

    - name: Set firewalld default zone to drop
      ansible.posix.firewalld:
        zone: public
        state: enabled
        permanent: yes
        target: DROP

    - name: Reload firewalld to apply permanent changes
      ansible.builtin.command: firewall-cmd --reload

    - name: Allow custom SSH port in firewalld
      ansible.posix.firewalld:
        port: "{{ ssh_port }}/tcp"
        permanent: true
        state: enabled
        immediate: true

    - name: Allow Endlessh port in firewalld
      ansible.posix.firewalld:
        port: "{{ endlessh_port }}/tcp"
        permanent: true
        state: enabled
        immediate: true

    - name: Ensure custom SSH port is set in sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?Port\s+'
        line: "Port {{ ssh_port }}"
        backup: yes
        validate: "/usr/sbin/sshd -T -f %s"
      register: sshd_config_changed

    - name: Gather SELinux facts
      ansible.builtin.setup:
        filter: ansible_selinux

    - name: Allow SSH to use custom port in SELinux
      ansible.builtin.command: >
        semanage port -a -t ssh_port_t -p tcp {{ ssh_port }}
      register: semanage_result
      failed_when: semanage_result.rc not in [0, 1]
      changed_when: semanage_result.rc == 0
      when: ansible_selinux.status == "enabled"

    - name: Restart and enable sshd service if needed
      ansible.builtin.service:
        name: sshd
        state: restarted
        enabled: true
      when: sshd_config_changed is changed