---
#   remove user from pffile
#   User info comes from datadir
#   vars:
#     USERLOGIN is given to playbook on commandline
#     vault_gitea_apikey comes from VAULTS internalit/vault_perfact_useradmin.yml

- name: perfact_deluser - exit if USERLOGIN is not given on commandline
  meta: end_play
  run_once: true
  when: USERLOGIN is undefined
  # always execute
  check_mode: false

# delete useraccount from pffile
- when: inventory_hostname == "pffile"
  become: true
  block:

    - name: remove signature
      ansible.builtin.blockinfile:
        path: /opt/perfact/create_signature/data_source_users.py
        marker: "# {mark} CREATED BY ANSIBLE can be modified manually {{ USERLOGIN }}"
        block: ""

    - name: perfact_deluser pffile commit to git create_signature
      # later on pf-login, we run as perfact-userlogin
      # on pffile we run as root for now
      ansible.builtin.shell: 'git add . ; git commit -m "perfact_deluser {{ USERLOGIN }} - Changes by Ansible"'
      args:
        chdir: /opt/perfact/create_signature
      # ignore error if nothing to commit
      ignore_errors: true

    - name: pffile remove homedir
      ansible.builtin.file:
        path: "/homes/{{ USERLOGIN }}"
        state: absent

    - name: remove user from ldap
      ansible.builtin.debug:
        msg: "Please manually remove user from LDAP / LAM"

#    # Remove user from LDAP if present
#    # Will be done on new server perfact-login-prod
#
#    - name: perfact_deluser read VAULT for ldap-master
#      tags: always
#      ansible.builtin.include_vars:
#        file: internalit/vault_perfact_useradmin.yml
#      # not log passwords
#      diff: false
#
#    - name: perfact_deluser read VAR for ldap-master
#      tags: always
#      ansible.builtin.include_vars:
#        file: internalit/var_perfact_useradmin.yml
#      # not log passwords
#      diff: false
#
#    - name: check if user is present in ldap
#      ansible.builtin.command: "getent passwd {{ USERLOGIN }}"
#      register: pffile_getent_passwd
#      # also exec in check-mode:
#      check_mode: false
#      ignore_errors: true
