---
- name: Remove existing ctrl-alt-del.target symlink
  ansible.builtin.file:
    path: /etc/systemd/system/ctrl-alt-del.target
    state: absent

- name: "Mask Ctrl+Alt+Del target to prevent reboot"
  when: "linux_ctrl_alt_del_enabled | bool"
  ansible.builtin.systemd:
    name: "ctrl-alt-del.target"
    masked: true
    state: "stopped"
  register: "cad_mask_result"
  ignore_errors: true

# FIX: create the .target.d/ drop-in directory before writing into it.
# ansible.builtin.copy does NOT create missing parent directories.
- name: "Ensure ctrl-alt-del.target.d drop-in directory exists"
  when: "linux_ctrl_alt_del_enabled | bool"
  ansible.builtin.file:
    path: "/etc/systemd/system/ctrl-alt-del.target.d"
    state: "directory"
    mode: "0755"
    owner: "root"
    group: "root"

- name: "Deploy ctrl-alt-del override to reinforce mask"
  when: "linux_ctrl_alt_del_enabled | bool"
  ansible.builtin.copy:
    content: "[Unit]\nDescription=Ctrl-Alt-Del disabled by CyberAar hardening\n"
    dest: "/etc/systemd/system/ctrl-alt-del.target.d/override.conf"
    mode: "0644"
    owner: "root"
    group: "root"
  register: "cad_override_result"

- name: "Reload systemd daemon after mask/override"
  when: "cad_mask_result.changed or cad_override_result.changed"
  ansible.builtin.systemd:
    daemon_reload: true

- name: "Verify Ctrl+Alt+Del mask status (verbosity >=1)" # noqa: command-instead-of-module
  when: "ansible_verbosity >= 1"
  ansible.builtin.command: "systemctl is-enabled ctrl-alt-del.target"
  changed_when: false
  register: "cad_status"
  failed_when: false

- name: "Show Ctrl+Alt+Del mask status"
  when: "ansible_verbosity >= 1"
  ansible.builtin.debug:
    msg: "ctrl-alt-del.target status: {{ cad_status.stdout | default('unknown') }}"