- name: enable password auth
  copy:
    src: sshd_config
    dest: /etc/ssh/sshd_config
  notify: restart sshd

- name: ensure libselinux-python
  yum:
    name: libselinux-python
    update_cache: yes

- name: allow passwordless sudo for user
  lineinfile:
    dest: /etc/sudoers
    state: present
    line: '{{ username }} ALL=(ALL) NOPASSWD: ALL'

- name: disable requiretty
  lineinfile:
    dest: /etc/sudoers
    state: present
    line: Defaults    !requiretty
    regexp: ^Defaults

- name: disable selinux
  lineinfile:
    line: SELINUX=permissive
    state: present
    dest: /etc/selinux/config
    regexp: ^SELINUX=
  register: selinux_disable

- block:
    - name: reboot server
      shell: sleep 2 && shutdown -r 1 "selinux change...rebooting..."
      async: 0
      poll: 0
      ignore_errors: yes

    - name: wait for instance
      delegate_to: localhost
      become: no
      wait_for:
        port: 22
        host: '{{ ansible_host }}'
        search_regex: OpenSSH
        timeout: 500
        delay: 120
  when: selinux_disable|changed

- name: enable password auth
  copy:
    src: sshd_config
    dest: /etc/ssh/sshd_config
  notify: restart sshd

- name: Install firewalld and libselinux-python
  yum:
    name: "{{ item }}"
    state: present
  with_items:
    - libselinux-python
    - firewalld
  when:
    - "ansible_os_family == 'RedHat' or ansible_os_family == 'CentOS'"
    - "ansible_distribution_major_version | int >= 7"

- name: allow passwordless sudo for user
  lineinfile:
    dest: /etc/sudoers
    state: present
    line: '{{ username }} ALL=(ALL) NOPASSWD: ALL'

- name: disable requiretty
  lineinfile:
    dest: /etc/sudoers
    state: present
    line: Defaults    !requiretty
    regexp: ^Defaults

- name: disable selinux
  lineinfile:
    line: SELINUX=permissive
    state: present
    dest: /etc/selinux/config
    regexp: ^SELINUX=
  register: selinux_disable

- block:
    - name: reboot server
      shell: sleep 2 && shutdown -r 1 "selinux change...rebooting..."
      async: 0
      poll: 0
      ignore_errors: yes

    - name: wait for instance
      delegate_to: localhost
      become: no
      wait_for:
        port: 22
        host: '{{ ansible_host }}'
        search_regex: OpenSSH
        timeout: 500
        delay: 120
  when: selinux_disable|changed

Make sure firewalld is installed on instances
Make sure firewalld is installed on instances

This prevents tasks in the exercises from failing since some of the tasks disable firewalld
