---
- name: Daily Infrastructure Health & Configuration Drift Audit
  hosts: all:!synology_nas
  gather_facts: false
  tasks:
    - name: Audit system time sync status
      ansible.builtin.shell: systemctl is-active systemd-timesyncd || systemctl is-active chrony || systemctl is-active chronyd
      register: time_sync
      changed_when: false
      failed_when: time_sync.stdout != "active"

    - name: Audit Zabbix Agent 2 service status
      ansible.builtin.command: systemctl is-active zabbix-agent2
      register: zabbix_status
      changed_when: false
      failed_when: zabbix_status.stdout != "active"

    - name: Audit unified SSH key enrollment in authorized_keys
      ansible.builtin.shell: grep -q "snarfnet-automation-master@snarfnet.net" ~/.ssh/authorized_keys
      register: ssh_key_check
      changed_when: false
      failed_when: ssh_key_check.rc != 0

    - name: Display host audit status
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }} ({{ ansible_host }}) [OK]: TimeSync={{ time_sync.stdout }}, Zabbix={{ zabbix_status.stdout }}, SSHKey=Verified"