---
# run with:
#     ansible-playbook playbook_perfact_adduser.yml --ask-vault-password \
#       --extra-vars "USERLOGIN=... USERLAPTOPIP=..." --check
# or:
#     ansible-playbook playbook_perfact_adduser.yml --vault-password-file .vault-password-perfact-useradmin \
#       --extra-vars "USERLOGIN=... USERLAPTOPIP=..." --check

# required parameter --extra-vars "USERLOGIN=..."
# optional paramter  --extra-vars "USERLAPTOPIP=..."
# optional paramter  --extra-vars "Laptop_User=..."


# this will
#
# add host userlaptop
# read the passwords from password sheet
#
# add account to ldap
#     remote-add ldif via ssh-tunnel (login as useradmin)
# create account on perfact-mail (modifing ldap is enough)
# add user to pf-phonehome
# add key to perfact-login (now pffile)
# install software on latop
#
# delete the password-sheet from localdir !

- name: perfact_adduser exit if USERLOGIN is not given on commandline
  hosts: all # limited by run_once
  gather_facts: false
  tasks:
  - name: perfact_adduser exit if USERLOGIN is not given on commandline task
    tags: always
    ansible.builtin.fail:
      msg: "Error: USERLOGIN is not given on commandline"
    when: USERLOGIN is undefined
    run_once: true
    check_mode: false

- name: first add host userlaptop to inventory
  hosts: all   # limited by run_once
  gather_facts: false
  tasks:
  - name: add userlaptop to inventory in play
    ansible.builtin.add_host:
      name: userlaptop
      # set everything else later
    run_once: true
    # also run in check mode
    check_mode: false

## new infrastucture 2023

# read password sheet
- name: setup useraccount in ldap on perfact-login and create homedir on -file
  hosts:
    - perfact-login-prod
    - perfact-login-devel
#    - perfact-login-localdev
    - perfact-file-prod
    - perfact-file-devel
#    - perfact-file-localdev
  gather_facts: false
  tasks:
    - name: perfact_adduser ldap - read the passwords from password sheet for ldap
      tags: always
      ansible.builtin.include_vars:
        file: "password-sheet-{{ USERLOGIN }}"
      check_mode: false
      # not log passwords
      diff: false
      when: ('perfact-login-' in inventory_hostname)

    - name: setup user on perfact-login in ldap and homedir
      ansible.builtin.include_role: name=internalit/roles/perfact_adduser/perfact-login
      when: ('perfact-login-' in inventory_hostname)

    - name: setup user on perfact-file create homedir
      ansible.builtin.include_role: name=internalit/roles/perfact_adduser/perfact-file
      when: ('perfact-file-' in inventory_hostname)

#- name: check that there is no ssh key in datadir
#  host:
#    - perfact-login-prod
#    # only for development - remove localdev !
#    - perfact-login-localdev
#  gather_facts: false
#  delegate_to: localhost
#
#- name: get public ssh key and store to datadir
#    ansible.builtin.command: "sudo /opt/perfact/custom/perfact_useradmin.py file-sshkey-show --user {{ USERLOGIN }}"



################################
####    setup userlaptop    ####
################################

- name: setup userlaptop
  hosts:
  - userlaptop
  # facts are required by role perfact-repo, but no ssh is possible yet
  gather_facts: false
  tasks:
    - name: perfact_adduser - read the passwords from password sheet for userlaptop
      tags: always
      include_vars:
        file: "password-sheet-{{ USERLOGIN }}"
      check_mode: false
      # not log passwords
      diff: false

    - name: debug where am I 1
      debug:
        var: inventory_hostname

    # hint from review:
    # That is just my preference but for a role that will be included every time this role is run can we use import_role?
    # The two do pretty much the same thing but have a few key differences (https://docs.ansible.com/ansible/2.9/user_guide/playbooks_reuse.html#playbooks-reuse)

    - include_role: name=internalit/roles/perfact_adduser/userlaptop_enable_access
      when: inventory_hostname == 'userlaptop'

    - include_role: name=internalit/roles/perfact_adduser/userlaptop_install
      when: inventory_hostname == 'userlaptop'

    - include_role: name=internalit/roles/perfact_adduser/userlaptop_disable_access
      when: inventory_hostname == 'userlaptop'

- name: setup useraccount at internal systems
  hosts:
    #- perfact-login-prod    # ldap master  (was done before laptop-install)
    #- perfact-file-prod     # only ldap account required
    #- perfact-mail-prod     # only ldap account required
    - pf-git
  gather_facts: false
  tasks:
    - name: debug where am i 2
      debug:
        var: inventory_hostname

    - name: perfact_adduser - read the passwords from password sheet for other hosts
      tags: always
      include_vars:
        file: "password-sheet-{{ USERLOGIN }}"
      check_mode: false
      # not log passwords
      diff: false
    # only required for git :
    - name: perfact_adduser read VAULT for other hosts
      tags: always
      ansible.builtin.include_vars:
        file: internalit/vault_perfact_useradmin.yml
      # not log passwords
      diff: false
    # only required for git :
    - name: perfact_adduser read VAR for other hosts
      tags: always
      ansible.builtin.include_vars:
        file: internalit/var_perfact_useradmin.yml
      # not log passwords
      diff: false

    - include_role: name=internalit/roles/perfact_adduser/gitea_users
      when: inventory_hostname == 'pf-git'
