# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_ipv6_option_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Disable IPv6 Networking kernel module
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/ipv6.conf
    regexp: ^options\s+ipv6\s+disable=\d
    line: options ipv6 disable=1
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_ipv6_option_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure disable_ipv6 (all and default) is set to 1
  ansible.posix.sysctl:
    name: '{{ item }}'
    value: '1'
    state: present
    reload: true
  with_items:
  - net.ipv6.conf.all.disable_ipv6
  - net.ipv6.conf.default.disable_ipv6
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_ipv6_option_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
