---
# Remount and persist secure options using defaults variables

- name: Gather mount facts
  ansible.builtin.setup:
    filter: ansible_mounts

- name: Ensure /tmp has secure mount options
  ansible.builtin.mount:
    path: /tmp
    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/tmp') | map(attribute='fstype') | first }}"
    opts: "{{ tmp_mount_options }}"
    state: mounted

- name: Ensure /var/tmp has secure mount options
  ansible.builtin.mount:
    path: /var/tmp
    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/var/tmp') | map(attribute='fstype') | first }}"
    opts: "{{ var_tmp_mount_options }}"
    state: mounted

- name: Ensure /home has secure mount options
  ansible.builtin.mount:
    path: /home
    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/home') | map(attribute='fstype') | first }}"
    opts: "{{ home_mount_options }}"
    state: mounted

- name: Ensure /dev/shm has secure mount options
  ansible.builtin.mount:
    path: /dev/shm
    fstype: tmpfs
    opts: "{{ dev_shm_mount_options }}"
    state: mounted