---
- name: restart auditd
  ansible.builtin.service:
    name: auditd
    state: restarted

- name: restart sshd
  ansible.builtin.service:
    name: ssh
    state: restarted

- name: apply sysctl
  ansible.builtin.command: sysctl --system
  changed_when: true

- name: update initramfs
  ansible.builtin.command: update-initramfs -u
  changed_when: true

- name: remount tmp
  ansible.builtin.command: mount -o remount /tmp
  changed_when: true
  failed_when: false  # best effort, siehe Kommentar in tasks/mounts.yml

- name: remount shm
  ansible.builtin.command: mount -o remount /dev/shm
  changed_when: true
  failed_when: false

- name: reload systemd (os_hardening)
  ansible.builtin.systemd:
    daemon_reload: true