---
- name: Sanity checks
  assert:
    that:
      - inventory_hostname not in list_of_lxc_hosts|default(groups.lxc_hosts)
      - ssh_keys is defined and ssh_keys is iterable and ssh_keys != []
      - service_user is not defined or service_user|regex_search('^[a-z][a-z0-9-]+$')


- name: Check for no-validate parameter in download template
  shell:
    cmd: "/usr/share/lxc/templates/lxc-download --help | grep no-validate || true"
  changed_when: false
  register: lxc_download_validate
  delegate_to: "{{ ansible_host|default('localhost') }}"


- name: Get architecture
  shell: "uname -m || true"
  changed_when: false
  register: lxc_host_arch_native
  delegate_to: "{{ ansible_host|default('localhost') }}"


- name: Create LXContainer
  lxc_container:
    name: "{{ inventory_hostname }}"
    state: started
    template: download
    template_options: "-a {{ architecture_mapping[lxc_host_arch_native.stdout] }} -d {{ os_d }} -r {{ os_r }} {% if 'no-validate' in lxc_download_validate.stdout %}--no-validate{% endif %}"
    config: "{{ lxc_config_file|default('/etc/lxc/ansible.conf') }}"
    container_config:
      - "lxc.group = {{ os_d }}"
      - "lxc.group = {{ (cmdline_python[os_d][0]).split(' ')[0].split('-')[0] }}"
  register: lxc_created
  delegate_to: "{{ ansible_host|default('localhost') }}"


- pause:
    seconds: 10
  when: lxc_created is changed


- name: Check for default route
  raw: "ip route | grep default"
  changed_when: False


- name: Raw-Install Python3
  raw: "{{ item }}"
  loop: "{{ cmdline_python[os_d] }}"
  when: use_python2 != True


- name: Raw-Install Python2
  raw: "{{ item }}"
  loop: "{{ cmdline_python2[os_d] }}"
  when: use_python2 == True


- name: OS-dependent fixes
  raw: "{{ item }}"
  loop: "{{ cmdline_fixes[os_d][os_r]|default([]) }}"


- setup:


- name: Set root password
  shell:
    cmd: "echo root:{{ root_password|default('root') }} | chpasswd -c SHA256"


- name: Add SSH keys
  block:
    - name: "1st try: authorized_key module"
      authorized_key:
        user: root
        key: "{{ item }}"
      loop: "{{ ssh_keys }}"
  rescue:
    - name: "2nd try: create ~/.ssh directory"
      file:
        path: /root/.ssh/
        state: directory
        owner: root
        group: root
        mode: 0700
    - name: "2nd try: add key via lineinfile module"
      lineinfile:
        path: /root/.ssh/authorized_keys
        line: "{{ item }}"
        owner: root
        group: root
        mode: 0600
        create: yes
        backup: yes
      loop: "{{ ssh_keys }}"


- name: "[BLOCK] when 'service_username' is set"
  when: service_username is defined
  block:

    - name: 'Add normal user "{{ service_username }}"'
      user:
        name: "{{ service_username }}"
        shell: "{{ user_shell[os_d]|default('/bin/bash') }}"

    - name: 'Set password for user "{{ service_username }}"'
      shell:
        cmd: "echo {{ service_username }}:{{ service_password|default(service_username) }} | chpasswd -c SHA256"

    - name: Add SSH keys
      block:
        - name: "1st try: authorized_key module"
          authorized_key:
            user: "{{ service_username }}"
            key: "{{ item }}"
          loop: "{{ ssh_keys_service|default(ssh_keys) }}"
      rescue:
        - name: "2nd try: get homedir of user"
          getent:
            database: passwd
            key: "{{ service_username }}"
            split: ":"
        - name: "2nd try: create ~/.ssh directory"
          file:
            path: "{{ getent_passwd[service_username][4] }}/.ssh/"
            state: directory
            owner: "{{ service_username }}"
            group: "{{ service_username }}"
            mode: 0700
        - name: "2nd try: add key via lineinfile module"
          lineinfile:
            path: "{{ getent_passwd[service_username][4] }}/.ssh/authorized_keys"
            line: "{{ item }}"
            owner: "{{ service_username }}"
            group: "{{ service_username }}"
            mode: 0600
            create: yes
            backup: yes
          loop: "{{ ssh_keys }}"

    - name: Install sudo
      package:
        name: sudo

    - name: Add sudo line for service
      lineinfile:
        path: "/etc/sudoers.d/{{ service_username }}"
        regexp: "^service"
        line: "{{ service_username }} ALL=(ALL:ALL) NOPASSWD: ALL"
        create: yes
        backup: yes


- name: Install SSH
  package:
    name: "{{ ssh_package_name[ansible_os_family|lower]|default('openssh-server') }}"
    state: latest


- name: "Set «PermitRootLogin» to «yes»"
  lineinfile:
    dest: "{{ ssh_config_filename[os_d][os_r]|default('/etc/ssh/sshd_config') }}" # FIXME
    regexp: '^[#\s]*PermitRootLogin'
    line: "PermitRootLogin yes"
    create: yes
    backup: yes
  notify: "Restart SSH"


- name: Enable SSH
  service:
    name: "{{ ssh_service_name[ansible_os_family|lower]|default('sshd') }}"
    enabled: yes


- name: Start SSH
  service:
    name: "{{ ssh_service_name[ansible_os_family|lower]|default('sshd') }}"
    state: started
  ignore_errors: yes