---
- hosts: tag_os_platform_linux
  become: yes
  become_user: root
  become_method: sudo
  roles:
    - role: arillso.hosts
    - role: matic-insurance.deep-security-agent
      dsa_policy_name: 'EC2 Instance'
    - role: racqspace.unattended_upgrades
      unattended_upgrades_automatic_reboot: true
      unattended_upgrades_automatic_reboot_time: 01:00
      unattended_upgrades_remove_unused_dependencies: true
      unattended_upgrades_origins_patterns: [
        'origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu',
        'origin=Ubuntu,archive=${distro_codename}-updates,label=Ubuntu',
        'origin=Ubuntu,archive=${distro_codename}-backports,label=Ubuntu',
        'origin=Ubuntu,archive=${distro_codename},label=Ubuntu'
      ]
      when: ansible_pkg_mgr == "apt" and not ansible_check_mode
    - role: yum_cron
      yum_cron_reboot_hour: 1
      when: ansible_pkg_mgr == "yum" and not ansible_check_mode

- hosts: tag_splunk_true
  become: yes
  become_user: root
  become_method: sudo
  roles:
    - role: splunk
    - role: qualys

#- hosts: tag_os_platform_windows
#  roles:
#   - name: Install all critical and security updates
#     win_updates:
#       category_names:
#         - CriticalUpdates
#         - SecurityUpdates
#       state: installed
#     register: update_result
#
#   - name: Reboot host if required
#     win_reboot:
#     when: update_result.reboot_required

#   - name: Create local user
#     win_user:
#       name: '{{ item.name }}'
#       password: '{{ item.password }}'
#       groups: Administrators
#       update_password: no
#       password_never_expires: yes
#     loop:
#       - name: aslabospitsky
#         password: changeme!
#       - name: bbabii
#         password: changeme!
#       - name: tshagapov
#         password: changeme!