---
# user setup on proxmox PVE node

- name: include role perfactusers-service-accounts
  # create separate users for perfact employees
  # add them to group perfact_service
  # and deploys their ssh-keys
  include_role:
    name: general/perfactusers-service-accounts

# from this role we get the dict: 'relevant_users'


### Setup Proxmox VE ###
- name: add proxmox group
  become: true
  ansible.builtin.command: /usr/sbin/pveum group add pve-user
  # tasks failes if groups already exists, we simply ignore it
  ignore_errors: true

- name: setup PVE group permissions
  become: true
  ansible.builtin.command: "/usr/sbin/pveum acl modify {{ item.path }} -roles {{ item.roleid }} -groups pve-user"
  loop:
   -  { path: '/nodes', roleid: 'PVEVMAdmin' }
   -  { path: '/pool', roleid: 'PVEVMAdmin' }
   -  { path: '/storage', roleid: 'PVEVMAdmin' }
   -  { path: '/storage', roleid: 'PVEAdmin' }
   -  { path: '/vms', roleid: 'PVEVMAdmin' }


- name: add proxmox user
  become: true
  ansible.builtin.command: /usr/sbin/pveum useradd -groups pve-user "{{ item }}@pam"
  with_items: "{{ relevant_users.keys() | list }}"
  # tasks failes if user already exists, we simply ignore it
  ignore_errors: true

- name: add proxmox user to group
  become: true
  ansible.builtin.command: /usr/sbin/pveum user modify -groups pve-user "{{ item }}@pam"
  with_items: "{{ relevant_users.keys() | list }}"

# TODO: find a way, that user can set their own password for gui usage.
# HINT: passwd as user does not work, because shadow is looked with "!"
