---

- name: add pf_backup ssh-key to client
  become: yes
  authorized_key:
    exclusive: no
    user: root
    comment: 'backuppc@pf-backup'
    # only set "from" for hosts which don't have option ssh_no_limiting_from
    # TODO option 'in_quadrant_network'?
    key_options: "{{ { true: '', false: 'from=\"192.168.42.100\"' }[quadrant_backup['ssh_no_limiting_from'] | default(false)] }}"
    key: "{{ pf_backup_public_key }}"
    state: present
    manage_dir: no
  # do not install if no_sshd -server is to be configured
  when:  (not no_sshd | default(false))

- block:
  - name: get filename of firewallscript01
    # other clients don´t need to open the firewall
    become: true
    command: 'grep FIREWALL_SCRIPT= /etc/default/pffirewall'
    register: myoutput

  - name: get filename of firewallscript02
    # other clients don´t need to open the firewall
    set_fact:
      # info list[0] gives first item
      FIREWALL_SCRIPT: "{{ myoutput.stdout_lines[0] | replace( 'FIREWALL_SCRIPT=\"', '' ) | replace( '\"', '' ) }}"

  - name: add firewall rule for backuppc
    # other clients don´t need to open the firewall
    become: true
    blockinfile:
      # path: /root/{{ FIREWALL_SCRIPT }}
      path: /etc/perfact/pffirewall/{{ FIREWALL_SCRIPT }}
      backup: true
      insertafter: '\s*setCurrentChains INT'
      block: |-
        #
        # allow ssh-connection from BackupPC
        clientRules $INT_IP 192.168.42.100/32 "22" tcp
      state: present
    # this will restart the firewall via handler - but will do it manually for now
    #notify:
    #- restart pffirewall
  # TODO what is this? where/how is that defined?
  when: inventory_hostname in ['host_that_needs_change_of_sshda', 'host_that_needs_change_of_sshb']

- include: allow_root_ssh.yml
  # allow ssh root login from the pfbackup
  # tyke is not in our lan and BackupPC will not connect from its ip:
  when: inventory_hostname not in ['tyke']

- include: database.yml
  when: quadrant_backup['database_backup'] | default(false)
