---
# roles/perfact_adduser/userlaptop_enable/tasks/main.yml

# parameters ---extra-vars "USERLOGIN=.... USERLAPTOPIP=...."
# optional, if different from USERLOGIN: Laptop_User=

# set up the ssh connection to the userlaptop

# run this task on userlatop   only if  USERLAPTOPIP is given on commandline check in enable_access
- when: inventory_hostname == "userlaptop"  and USERLAPTOPIP is defined
  run_once: true
  block:

    - name: set Laptop_User to USERLOGIN if not defined
      ansible.builtin.set_fact:
        Laptop_User: "{{ USERLOGIN }}"
      when: Laptop_User is undefined

    - name: perfact_adduser add userlaptop with all vars to inventory in ram
      ansible.builtin.add_host:
        name: userlaptop
        # ansible_ssh_host: "{{ USERLAPTOPIP }}" # No: conncet to hostname instead of IP
        ansible_user: "{{ Laptop_User }}"
        ansible_become_pass: "{{ Laptop_Userpassword }}"
      # do not log passwords
      diff: false
      # also run in check mode
      check_mode: false

    - name: set tigged_Userpassword to be used for shell-scripts later
      set_fact:
        tigged_Userpassword: "'{{ Laptop_Userpassword }}'"
      diff: false
      check_mode: false

    - name: perfact_adduser create local ssh config
      local_action:
        module: blockinfile
        path: ~/.ssh/config
        block: |
          Host		userlaptop
            Hostname	{{ USERLAPTOPIP }}
            User	{{ Laptop_User }}
            IdentityFile  "~/.ssh/id_rsa_perfact_adduser_{{ Laptop_User }}"
        marker: "# {mark} ANSIBLE MANAGED BLOCK userlaptop"
      check_mode: false

    # create ssh-key only to be used for userlaptop-login
    # 1. check if key exists
    - name: perfact_adduser check presence of ssh-key for userlaptop
      local_action: command ls -l  "~/.ssh/id_rsa_perfact_adduser_{{ Laptop_User }}"
      ignore_errors: true
      register: userlaptop_key_present
      # do not print the big red error
      no_log: true
      check_mode: false

    # 2. create key if not exists
    - name: perfact_adduser create local ssh-key for laptop access
      local_action: command ssh-keygen -t rsa -b 4096 -C key_from_installation_${USER} -N "" -f "~/.ssh/id_rsa_perfact_adduser_{{ Laptop_User }}"
      when: userlaptop_key_present.rc  != 0
      check_mode: false

    # authenticate ssh-connection to userlaptop
    - name: perfact_adduser add hostkey and allow login without password
      local_action: command /usr/bin/sshpass -p "{{ Laptop_Userpassword }}" /usr/bin/ssh-copy-id -o StrictHostKeyChecking=accept-new -o PreferredAuthentications=password -i "~/.ssh/id_rsa_perfact_adduser_{{ Laptop_User }}" userlaptop
      # do not log passwords
      diff: false

    ## Test as user and root
    #- name: do something on userlaptop
    #  file:
    #    path: "/home/{{ Laptop_User }}/Ansible_was_here"
    #    state: touch

    #- name: sudo something on userlaptop
    #  become: true
    #  file:
    #    path: "/root/Ansible_was_here"
    #    state: touch
    #  delegate_to: userlaptop
