---
# roles/perfact_adduser/userlaptop_disable_acces/tsasks/main.yml

# parameters ---extra-vars "USERLOGIN=.... USERLAPTOPIP=...."
# optional: Laptop_User=


- name: perfact_adduser exit if Laptop_User is not given on commandline check in disable_access
  meta: end_play
  run_once: true
  when: Laptop_User is undefined
  check_mode: false

# run this task on userlatop   only if  USERLAPTOPIP is given on commandline
- when: inventory_hostname == "userlaptop"  and USERLAPTOPIP is defined
  run_once: true
  block:

    # cleanup ssh connection (remove ssh-keys remote and local, clean ssh-config)
    - name: perfact_adduser remove ssh-key from laptop
      file:
        path: "/home/{{ Laptop_User }}/.ssh/authorized_keys"
        state: absent

    - name: perfact_adduser delete local ssh-key
      local_action: command rm "~/.ssh/id_rsa_perfact_adduser_{{ Laptop_User }}"

    - name: perfact_adduser delete local ssh-key.pub
      local_action: command rm "~/.ssh/id_rsa_perfact_adduser_{{ Laptop_User }}.pub"
      check_mode: false

    - name: perfact_adduser clean local ssh config
      local_action:
        module: blockinfile
        path: ~/.ssh/config
        marker: "# {mark} ANSIBLE MANAGED BLOCK userlaptop"
        state: absent
      check_mode: false

