---
- name: "Configure hardened options for mount {{ mount.path }}"
  ansible.posix.mount:
    path: "{{ mount.path }}"
    src: "{{ mount.src | default(mountinfo.device, true) }}"
    fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
    opts: "{{ mount.opts }}"
    dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
    passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
    state: present
  register: mountpoint
  when:
    - mount.enabled | bool
    - mount.path in mountpoints_list
  vars:
    mountinfo: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
  notify: Remount filesystems

- name: "Check for existence of mount {{ mount.path }}"
  ansible.builtin.stat:
    path: "{{ mount.path }}"
  register: mountpoint_exists

- name: "Harden permissions for directory of mount {{ mount.path }}"
  ansible.builtin.file:
    dest: "{{ mount.path }}"
    owner: "{{ mount.owner }}"
    group: "{{ mount.group }}"
    mode: "{{ mount.mode }}"
  when:
    - mountpoint_exists.stat.exists | bool

- name: "Register changed mountpoints"
  ansible.builtin.set_fact:
    mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
  when: mountpoint.changed  # noqa no-handler