---
- name: Proxmox VE hardening
  hosts: proxmox
  become: true
  gather_facts: true

  pre_tasks:
    - name: Confirm this is a Proxmox VE host
      ansible.builtin.assert:
        that:
          - ansible_os_family == "Debian"
          - ansible_facts.packages is not defined or true
        fail_msg: "This playbook targets Proxmox VE (Debian-based) hosts only."
      tags: always

  roles:
    - role: proxmox-hardening
      tags: proxmox