---
- name: Configure host firewall (nftables)
  ansible.builtin.include_tasks: firewall.yml
  tags: [firewall]

- name: SSH hardening
  ansible.builtin.include_tasks: ssh.yml
  tags: [hardening]

- name: Fail2ban intrusion deterrence
  ansible.builtin.include_tasks: fail2ban.yml
  tags: [hardening]