---
# tasks file for users
- name: create local ssh_key_directory
  file:
    path: "{{ users_ssh_key_directory }}"
    state: directory
    mode: "0750"
  when:
    - user.manage_ssh_key is defined
    - user.manage_ssh_key | bool
  delegate_to: localhost
  become: no

- name: manage users {{ user.name }}
  user:
    name: "{{ user.name }}"
    state: "{{ user.state | default('present') }}"
    comment: "{{ user.comment | default(omit) }}"
    password: "{{ user.password | default(omit) }}"
    uid: "{{ user.uid | default(omit) }}"
    group: "{{ user.group | default(omit) }}"
    groups: "{{ user.groups | default(omit) }}"
    shell: "{{ user.shell | default(users_shell) }}"
    update_password: "{{ user.update_password | default(omit) }}"
    expires: "{{ user.expires | default(omit) }}"
  register: users_manage_user

- name: set sudo options for {{ user.name }}
  template:
    src: sudo.j2
    dest: "/etc/sudoers.d/{{ user.name }}"
    mode: "0640"
  when:
    - user.sudo_options is defined
  loop_control:
    label: "{{ user.name }}"

- name: remove sudo options for {{ user.name }}
  file:
    path: "/etc/sudoers.d/{{ user.name }}"
    state: absent
  when:
    - user.sudo_options is not defined
  loop_control:
    label: "{{ user.name }}"

- name: generate private ssh key for {{ user.name }}
  command: "{{ users_ssh_keygen_command }}"
  args:
    creates: "{{ users_ssh_key_directory }}/{{ user.name }}"
  when:
    - user.manage_ssh_key is defined
    - user.manage_ssh_key | bool
  loop_control:
    label: "{{ user.name }}"
  delegate_to: localhost
  become: no

- name: generate public ssh key for {{ user.name }}
  shell: "{{ users_ssh_keygen_pubkey_command }} > {{ users_ssh_key_directory }}/{{ user.name }}.pub"
  args:
    creates: "{{ users_ssh_key_directory }}/{{ user.name }}.pub"
  when:
    - user.manage_ssh_key is defined
    - user.manage_ssh_key | bool
  loop_control:
    label: "{{ user.name }}"
  delegate_to: localhost
  become: no

- name: convert ssh key to ppk for {{ user.name }}
  shell: >
         ssh-keygen -e -f "{{ users_ssh_key_directory }}/{{ user.name }}"
         -C "Generated by Ansible role robertdebock.users"
         > "{{ users_ssh_key_directory }}/{{ user.name }}.ppk"
  args:
    creates: "{{ users_ssh_key_directory }}/{{ user.name }}.ppk"
  when:
    - user.manage_ssh_key is defined
    - user.manage_ssh_key | bool
  delegate_to: localhost
  become: no

- name: create .ssh directory for {{ user.name }}
  file:
    path: "/home/{{ user.name }}/.ssh"
    state: directory
    mode: "700"
  become: yes
  become_user: "{{ user.name }}"
  when:
    - user.manage_ssh_key is defined
    - user.manage_ssh_key

- name: loop over authorized_keys for {{ user.name }}
  include: user_authorized_key.yml
  loop: "{{ user.authorized_keys }}"
  loop_control:
    label: "{{ user.name }}"
    loop_var: authorized_key
  when:
    - user.authorized_keys is defined

- name: copy generated private ssh key for {{ user.name }}
  copy:
    src: "{{ users_ssh_key_directory }}/{{ user.name }}"
    dest: "/home/{{ user.name }}/.ssh/id_rsa"
    mode: "400"
    owner: "{{ user.name }}"
    group: "{{ user.group | default(omit) }}"
  loop: "{{ lookup('dict', users_manage_user, wantlist=True) }}"
  when:
    - users_manage_user is defined
    - user.copy_private_key is defined
    - user.copy_private_key | bool
  loop_control:
    label: "{{ user.name }}"

- name: check users password valid time
  command: awk 'BEGIN { FS = ":" } $1 == "{{ user.name }}" { print $5 }' /etc/shadow
  register: users_pw_valid
  changed_when: no
  check_mode: no
  when:
    - user.state is defined and user.state != "absent" or
      user.state is not defined

- name: set users password valid time
  command: chage -M "{{ user.password_validity_days }}" "{{ user.name }}"
  when:
    - user.password_validity_days is defined
    - users_pw_valid.stdout is defined
    - users_pw_valid.stdout | int !=  user.password_validity_days | int