---
- name: restart_sshd
  become: true
  ansible.builtin.service:
    name: sshd
    state: restarted

- name: restart_fail2ban
  become: true
  ansible.builtin.service:
    name: fail2ban
    state: restarted

# Guarded: a config change still notifies this handler when graylog_enabled is
# false, and an unconditional restart would start the service the fluent-bit
# task just stopped.
- name: restart fluent-bit
  become: true
  ansible.builtin.systemd:
    name: fluent-bit
    state: restarted
  when: graylog_enabled | bool

- name: restart_journald
  become: true
  ansible.builtin.systemd:
    name: systemd-journald
    state: restarted

# --reload-rules alone only affects devices that appear later; the root disk is
# already attached, so trigger a change event to apply the rule now rather than
# at the next reboot.
- name: reload_udev
  become: true
  ansible.builtin.shell: |
    udevadm control --reload-rules
    udevadm trigger --subsystem-match=block --action=change
  changed_when: true