---
# add user and group 'perfact-useradmin' and deploy ssh-keys

- name: create perfact-useradmin group
  tags: perfact_useradmin
  become: true
  group:
    name: "perfact-useradmin"

- name: create perfact-useradmin for perfact-employees
  tags: perfact_useradmin
  become: true
  ansible.builtin.user:
    name: "perfact-useradmin"
    groups: "perfact-useradmin"
    shell: "/bin/bash"

#- name: show what we get  "users | dict2items"
#  tags: perfact_useradmin
#  debug:
#    msg: "{{ users | dict2items | to_nice_yaml }}"
#
# key: amustermann
#   value:
#     ...
#     perfact_useradmin: true
#     ...

- name: filter existing user dictionary if user has perfact_useradmin = true
  tags: perfact_useradmin
  set_fact:
    users_perfact_useradmin: '{{ users | dict2items | rejectattr("value.perfact_useradmin", "undefined") | selectattr("value.perfact_useradmin", "equalto", true) | list | items2dict }}'

#- name: show users_perfact_useradmin
#  tags: perfact_useradmin
#  debug:
#    var: users_perfact_useradmin

- name: compile ssh key list perfact_useradmin
  tags: perfact_useradmin
  set_fact:
    useradmin_ssh_keys: "{{ users_perfact_useradmin.values() | map(attribute='ssh_keys') | map(attribute='pffile') | list }}"

- name: make shure list useradmin_ssh_keys is not empty
  tags: perfact_useradmin
  assert:
    that:
      - useradmin_ssh_keys | length > 0

#- name: user_perfact_useradmin debug ssh_keys
#  tags: perfact_useradmin
#  debug:
#    var: useradmin_ssh_keys

- name: perfact_useradmin Deploy SSH-Keys to remote host
  tags: perfact_useradmin
  become: True
  ansible.builtin.authorized_key:
    user: "perfact-useradmin"
    key: "{{ useradmin_ssh_keys | join('\n') }}"
    path: "/home/perfact-useradmin/.ssh/authorized_keys"
    exclusive: True

# add sudo script to host and add necessary password files
- name: perfact_useradmin add requirement python3-ldap on perfact-login*
  tags: perfact_useradmin
  become: true
  ansible.builtin.apt:
    pkg: python3-ldap
    state: present
  when: (( 'perfact-login-' in  inventory_hostname ) or ( 'perfact-mail-' in  inventory_hostname ) or ( 'perfact-file-' in inventory_hostname ))

- name: perfact_useradmin add dir /opt/perfact/custom
  tags: perfact_useradmin
  become: true
  ansible.builtin.file:
    dest: /opt/perfact/custom
    state: directory
    owner: "root"
    group: "root"
    mode: '0755'

- name: perfact_useradmin add scripts
  tags: perfact_useradmin
  become: true
  ansible.builtin.template:
    src: "{{ item }}"
    dest: "/opt/perfact/custom/{{ item }}"
    owner: "root"
    group: "perfact-useradmin"
    mode: '0750'
  with_items:
  - perfact_useradmin.py
  - perfact_useradmin_functions.py
  - update_pf_verbindungskonfiguration.sh

- name: perfact_useradmin add scripts to perfact-ema-2022*
  tags: perfact_useradmin
  become: true
  ansible.builtin.template:
    src: "{{ item }}"
    dest: "/opt/perfact/custom/{{ item }}"
    owner: "root"
    group: "perfact-useradmin"
    mode: '0750'
  with_items:
  - show_single_cryptinfo.sh
  when: ("perfact-ema-2022-" in inventory_hostname)

# add python2 to perfact-login* because the scripts
#   /opt/perfact/pf_verbindungskonfiguration/do_all
#   /opt/perfact/create_signature/create_signature.py
# are not compatible with python3 (yet)
- name: perfact_useradmin add requirement python2 on perfact-login*
  tags: perfact_useradmin
  become: true
  ansible.builtin.apt:
    pkg: python2.7
    state: present
  when: ( 'perfact-login-' in  inventory_hostname ) and ( not ansible_distribution_release == 'bookworm' )

- name: perfact_useradmin allow sudo
  tags: perfact_useradmin
  become: true
  ansible.builtin.template:
    src: sudoers_perfact_useradmin
    dest: /etc/sudoers.d/perfact_useradmin
    owner: "root"
    group: "root"
    mode: '0440'

- name: perfact_useradmin add dir /etc/perfact/
  tags: perfact_useradmin
  become: true
  ansible.builtin.file:
    dest: /etc/perfact/
    state: directory
    owner: "root"
    group: "root"
    mode: '0755'

- name: perfact_useradmin copy password file to ldap-master
  tags: perfact_useradmin
  become: true
  ansible.builtin.template:
    src: ldap_useradmin_pass.ini
    dest: /etc/perfact/ldap_useradmin_pass.ini
    owner: "root"
    group: "root"
    mode: '0600'
  diff: false
  when: ( 'perfact-login-' in  inventory_hostname )
