---
- name: Apply selected baseline Debian and Ubuntu hardening controls
  hosts: linux
  become: true
  gather_facts: true

  roles:
    - role: cis-debian-ubuntu-hardening
      tags:
        - cis
        - hardening

  post_tasks:
    - name: Show validation summary
      ansible.builtin.debug:
        var: cis_validation_summary
      when: cis_validation_summary is defined
      tags:
        - always
        - postcheck