---
# Bound the journal. Container stdout all lands here (log_driver=journald) and
# is shipped to Graylog by fluent-bit, so the local journal only needs to be a
# buffer -- see the template for the reasoning behind the size.
- name: ensure journald drop-in directory exists
  become: true
  ansible.builtin.file:
    path: /etc/systemd/journald.conf.d
    state: directory
    owner: root
    group: root
    mode: 0755
  tags: security, service, journald

- name: cap journald disk usage
  become: true
  ansible.builtin.template:
    src: journald-size.conf.j2
    dest: /etc/systemd/journald.conf.d/99-size.conf
    owner: root
    group: root
    mode: 0644
  notify: restart_journald
  tags: security, service, journald

- name: ensure desired services are started and enabled
  become: true
  ansible.builtin.service:
    name: "{{ item }}"
    state: started
    enabled: true
  loop: "{{ services }}"
  tags: security, service