---
# run with:
#     ansible-playbook playbook_perfact_deluser.yml --ask-vault-password \
#       --extra-vars "USERLOGIN=..." --check
# or:
#     ansible-playbook playbook_perfact_deluser.yml --vault-password-file .vault-password-perfact-useradmin \
#       --extra-vars "USERLOGIN=..." --check

# required parameter --extra-vars "USERLOGIN=..."


# this will
#
# del useraccount on all internal systems
#
# disable passowrd account on perfact-mail (modifing ldap is enough)
# remove user from pf-phonehome
# remove key and account from perfact-login (now pffile)

- name: delete useraccount from internal systems
  hosts:
  # many hosts are still deactivated during development
    - pffile                # remove later
    #- pf-mail               # deactivated 03.07.2023
    #- perfact-login         # TODO: ldap master
    #                        # remove account from ldap
    #- perfact-file          # host does not exists yet
    #                        # remove homedir
    #- perfact-mail-prod     # host does not exists yet
    #                        # remove from distridution lists
    #                        # create autoresponder
    #- perfact-login-devel   #
    #- perfact-mail-devel    #
    #- perfact-login-localdev #
    #- perfact-mail-localdev #
    - pf-git
    - pf-phonehome-2020-prod
  gather_facts: false
  tasks:
    - name: debug where am i 2
      debug:
        var: inventory_hostname

    - name: perfact_deluser - exit if USERLOGIN is not given on commandline
      meta: end_play
      run_once: true
      when: USERLOGIN is undefined
      # always execute
      check_mode: false

    - name: perfact_deluser read VAULT for other hosts
      tags: always
      ansible.builtin.include_vars:
        file: internalit/vault_perfact_useradmin.yml
      # not log passwords
      diff: false
    - name: perfact_deluser read VAR for other hosts
      tags: always
      ansible.builtin.include_vars:
        file: internalit/var_perfact_useradmin.yml
      # not log passwords
      diff: false

    #- include_role: name=internalit/roles/perfact_deluser/pf-mail_del_user
    #  when: inventory_hostname == 'pf-mail'

    - include_role: name=internalit/roles/perfact_deluser/gitea_del_user
      when: inventory_hostname == 'pf-git'

    - include_role: name=internalit/roles/perfact_deluser/pffile_del_user
      when: inventory_hostname == 'pffile'

    - include_role: name=internalit/roles/perfact_deluser/pf-phonehome_del_user
      when: inventory_hostname == 'pf-phonehome-2020-prod'

#    - include_role: name=internalit/roles/perfact_login/perfact-login_del_user
#      when: 'perfact-login' in inventory_hostname

    - name: remove user from datadir
      delegate_to: localhost
      run_once: true
      ansible.builtin.file:
        path: "data/users/{{ USERLOGIN }}"
        state: absent

    - name: hint commit to ansible
      run_once: true
      debug:
        msg: "Please add and commit change to Ansible repository"
