---
# Creates a non-root admin user with sudo and the homelab SSH keys on every
# reachable Ubuntu/Rocky guest. First step toward running Ansible as a
# non-root user.
#
# Extra vars (optional):
#   admin_user          - default harry
#   admin_sudo_nopasswd - default true (required for unattended become)
#   admin_ssh_keys      - list of public keys (defaults to the ansible-key and
#                         the personal key already used by add_root_key.yml)

- name: Check Host Availability
  hosts: ubuntu:rocky
  gather_facts: false
  ignore_unreachable: true

  tasks:
    - name: Ping hosts to check availability
      ansible.builtin.ping:
      register: ping_result
      ignore_errors: true
      ignore_unreachable: true

    - name: Add reachable hosts to group
      ansible.builtin.group_by:
        key: reachable_hosts
      when: ping_result is reachable and ping_result is succeeded

    - name: Report offline hosts
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }} - OFFLINE"
      when: ping_result is unreachable or ping_result is failed
      delegate_to: localhost

- name: User Setup - Create admin user on Ubuntu
  hosts: ubuntu:&reachable_hosts
  become: true
  gather_facts: false

  vars:
    admin_user: harry

  tasks:
    - name: Create admin user in the sudo group - {{ admin_user }}
      ansible.builtin.user:
        name: "{{ admin_user }}"
        shell: /bin/bash
        groups: sudo
        append: true
        create_home: true

- name: User Setup - Create admin user on Rocky Linux
  hosts: rocky:&reachable_hosts
  become: true
  gather_facts: false

  vars:
    admin_user: harry

  tasks:
    - name: Create admin user in the wheel group - {{ admin_user }}
      ansible.builtin.user:
        name: "{{ admin_user }}"
        shell: /bin/bash
        groups: wheel
        append: true
        create_home: true

- name: User Setup - Authorized keys and sudo
  hosts: reachable_hosts
  become: true
  gather_facts: false

  vars:
    admin_user: harry
    admin_sudo_nopasswd: true
    admin_ssh_keys:
      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key"
      - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbFKxd6W+gHcNrugkxMwvixGmk3LxtsMEnSdaFp4L78WZ4VhdZrsnSJQ/rViT+vuc6K5SeugtggfQ90L25UyyMv2BhLZaoMS2dpoVJEZon/Y2Hemm11vdEApAK/u0kPTTM5JB0/TZfpoP9sr4pmRIUruRXBhLDvtUV9tJvKSzbhChtB+vBg+MpywG9VvDP6eCVpFaP43RcAFtJR7irJmexd5m4CVhIFaWNeTbbe8YI08i2gDinYl95ygu9i/TorQKLWme2v9ejxQFfJTWGaXHnQ18W0X94Ns4a4OccGcvJ8JmvYsaAPRAOSveq1Fpdw1VXHSKigTmRl6pHWd9/rq6K6Ojctbjo1kHiNHdLKLZbLDeM0OQlzNl74snsImmZddY59wnOKyHtfY0ZI7sQ+7A/0cSaMY6h7lt2xK0WmayuoT8UtKZlItZHCkOA5bV29arI/HTz+yR/LW8SihPPFpVv5aDiOUs0PYd9j0+CtULBJeYpMQJpkD93g06vgEJjhUOBZ6JmilxVDihDARU0x0xiRCQJcq4Nhk/x3GzPe2kkrTI+nZFaQn1K8hcBdSyA12/xAG8Fh1SMCxLwJdCNuL3gQoYd6XPzKqn6BIqAgiyq5DbHhO6mehOye4Rro6i/H1UkZe862QH/R5uH+8Z2/FYRpiCPzQyLwrqx/eVfT7JMFQ== harwinder@harwinder.net"  # yamllint disable-line rule:line-length

  tasks:
    - name: Add authorized keys for {{ admin_user }}
      ansible.posix.authorized_key:
        user: "{{ admin_user }}"
        key: "{{ item }}"
        state: present
      loop: "{{ admin_ssh_keys }}"
      loop_control:
        label: "{{ item.split()[-1] }}"

    - name: Grant sudo to {{ admin_user }}
      ansible.builtin.copy:
        dest: "/etc/sudoers.d/90-{{ admin_user }}"
        content: "{{ admin_user }} ALL=(ALL) {{ 'NOPASSWD:' if admin_sudo_nopasswd | bool else '' }}ALL\n"
        owner: root
        group: root
        mode: '0440'
        validate: /usr/sbin/visudo -cf %s

    - name: Summary
      ansible.builtin.debug:
        msg: >-
          {{ inventory_hostname }} - user {{ admin_user }} ready
          (sudo {{ 'NOPASSWD' if admin_sudo_nopasswd | bool else 'with password' }}, {{ admin_ssh_keys | length }} key(s))