---
- hosts: _change_me_
  handlers:

  - name: restart ssh
    service:
      name: ssh
      state: restarted

  - name: reload sysctl settings
    command: /sbin/sysctl -p

  pre_tasks:

  - name: configure ssh
    copy:
      src: etc/ssh/sshd_config.d/zzz_local.conf
      dest: /etc/ssh/sshd_config.d/zzz_local.conf
      owner: root
      group: root
      mode: 0644
    notify:
      - restart ssh

  - name: configure sysctl
    copy:
      src: etc/sysctl.d/zzz_local.conf
      dest: /etc/sysctl.d/zzz_local.conf
      owner: root
      group: root
      mode: 0644
    notify:
      - reload sysctl settings

  - name: set permissions on root's home folder
    file:
      path: /root
      owner: root
      group: root
      mode: 0700

  - name: create ssh folder inside root's home folder
    file:
      path: /root/.ssh
      state: directory
      owner: root
      group: root
      mode: 0700

  - name: copying authorized_keys file to root's ssh folder
    copy:
      src: root/.ssh/authorized_keys
      dest: /root/.ssh/authorized_keys
      owner: root
      group: root
      mode: 0600

  - name: copying files to root's home folder
    copy:
      src: root/{{ item }}
      dest: /root/{{ item }}
      owner: root
      group: root
      mode: 0644
    loop:
      - .bashrc
      - .screenrc
      - .vimrc

  - name: check if /etc/skel/.bashrc_original file exists
    stat:
      path: /etc/skel/.bashrc_original
    register: etc_skel_bashrc_original

  - name: rename skel/.bashrc
    copy:
      remote_src: true
      src: /etc/skel/.bashrc
      dest: /etc/skel/.bashrc_original
    when: etc_skel_bashrc_original.stat.exists == false

  - name: copying files to /etc/skel folder
    copy:
      src: etc/skel/{{ item }}
      dest: /etc/skel/{{ item }}
      owner: root
      group: root
      mode: 0644
    loop:
    - .bashrc
    - .screenrc
    - .vimrc

  - name: update cache and upgrade installed packages
    apt:
      upgrade: dist
      update_cache: yes

  tasks:

  - name: install base packages
    apt:
      name:
        - aptitude
        - bash-completion
        - bind9-host
        - bzip2
        - chrony
        - cloud-init
        - etckeeper
        - git
        - htop
        - lbzip2
        - locales
        - man-db
        - multitail
        - net-tools
        - p7zip-full
        - rsync
        - screen
        - sed
        - ssl-cert
        - tar
        - vim-nox
        - xz-utils
      state: latest
      update_cache: no

  - name: configure locale
    locale_gen:
      name: "{{ item.name }}"
      state: "{{ item.state }}"
    loop:
      - name: de_DE.UTF-8
        state: present
      - name: en_GB.UTF-8
        state: present
      - name: en_US.UTF-8
        state: present

  - name: install packages for use of lxc containers
    apt:
      name:
        - acl
        - bridge-utils
        - libpam-cgfs
        - lxc
        - supervisor
        - uidmap
      state: latest
      update_cache: no

  - name: configure lxc usernet
    copy:
      src: etc/lxc/lxc-usernet
      dest: /etc/lxc/lxc-usernet
      owner: root
      group: root
      mode: 0644

  post_tasks:

  - name: add user (user)
    tags: user
    user:
      name: user
      create_home: yes
      shell: /bin/bash
      state: present
      password: _set_password_hash_with_quotes_

  - name: set permissions on user's home folder
    tags: user
    file:
      path: /home/user
      owner: user
      group: user
      mode: 0700

  - name: create ssh folder inside user's home folder
    tags: user
    file:
      path: /home/user/.ssh
      state: directory
      owner: user
      group: user
      mode: 0700

  - name: copying authorized_keys file to user's ssh folder
    tags: user
    copy:
      src: _users_/.ssh/authorized_keys
      dest: /home/user/.ssh/authorized_keys
      owner: user
      group: user
      mode: 0600

  - name: copying files to user's home folder
    tags: user
    copy:
      src: home/user/{{ item }}
      dest: /home/user/{{ item }}
      owner: user
      group: user
      mode: 0644
    loop:
      - .bashrc
      - .screenrc
      - .vimrc

  - name: create user's fonts folder
    tags: user
    file:
      path: /home/user/.local/share/fonts
      state: directory
      owner: user
      group: user
      mode: 0755

  - name: check if user has source code pro font already installed
    stat:
      path: /home/user/.local/share/fonts/source-code-pro-2.030R-ro-1.050R-it
    register: home_user_font_source_code_pro

  - name: copy font (source code pro) to user's fonts folder
    tags: user,with_fonts
    copy:
      src: home/user/.local/share/fonts/source-code-pro-2.030R-ro-1.050R-it/
      dest: /home/user/.local/share/fonts/source-code-pro-2.030R-ro-1.050R-it/
      owner: user
      group: user
      mode: 0644
    when: home_user_font_source_code_pro.stat.exists == false

  - name: add service user (service-database)
    user:
      name: service-database
      create_home: yes
      shell: /bin/bash
      state: present

  - name: add service user (service-files)
    user:
      name: service-files
      create_home: yes
      shell: /bin/bash
      state: present

  - name: set permissions on service users home folder
    file:
      path: /home/{{ item }}
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0711
    loop:
      - service-database
      - service-files

  - name: create ssh folder inside service users home folder
    file:
      path: /home/{{ item }}/.ssh
      state: directory
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0700
    loop:
      - service-database
      - service-files

  - name: copying authorized_keys file to service users ssh folder
    copy:
      src: _users_/.ssh/authorized_keys
      dest: /home/{{ item }}/.ssh/authorized_keys
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0600
    loop:
      - service-database
      - service-files

  - name: create bin folder inside service users home folder
    file:
      path: /home/{{ item }}/bin
      state: directory
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0700
    loop:
      - service-database
      - service-files

  - name: copying ssh_generate_config.sh to service users bin folder
    copy:
      src: _users_/bin/ssh_generate_config.sh
      dest: /home/{{ item }}/bin/
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0700
    loop:
      - 'service-database'
      - 'service-files'

  - name: copying ssh_generate_keypair.sh to service users bin folder
    copy:
      src: _users_/bin/ssh_generate_keypair.sh
      dest: /home/{{ item }}/bin/
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0700
    loop:
      - 'service-database'
      - 'service-files'

  - name: create lxc config folder for service users
    file:
      path: /home/{{ item }}/.config/lxc
      state: directory
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0700
    loop:
      - service-database
      - service-files

  - name: create lxc data folder for service users
    file:
      path: /home/{{ item }}/.local/share/lxc
      state: directory
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0711
    loop:
      - service-database
      - service-files

  - name: copying config file template to user's lxc config folder
    tags: user
    copy:
      src: _users_/.config/lxc/default.conf
      dest: /home/{{ item }}/.config/lxc/default.conf.template
      owner: '{{ item }}'
      group: '{{ item }}'
      mode: 0600
    loop:
      - 'service-database'
      - 'service-files'
