---
- name: init_login
  hosts: servers # @NOTE for IPv6, switch to 'servers6' instead of 'servers4'--for both, 'servers'
  vars_files:
    # @NOTE if second line is uncommented with its variables actively in use, first line should too be uncommented
    # - vars/ssh_keys_vault.yml
    - vars/ssh_keys.yml
  vars:
    ansible_user: "{{ passwords[0].username }}"
    ansible_ssh_user: "{{ passwords[0].username }}"
    # @NOTE one of below two lines should be commented/uncommented in a mutually exclusive fashion
    # ansible_ssh_private_key_file: "{{ chosen_native_ssh_private_key_file | default(chosen_local_ssh_private_key_file, true) }}" # @NOTE only works with soft-coded SSH key list building
    ansible_ssh_private_key_file: "{{ chosen_local_ssh_private_key_file }}"
    # @NOTE below three lines should only be uncommented when above two are commented and vice versa; key-based authentication should have already been enabled prior to running this playbook
    # ansible_password: "{{ passwords[0].password }}"
    # ansible_ssh_pass: "{{ passwords[0].username }}"
    # ansible_ssh_password: "{{ passwords[0].username }}"
    ansible_python_interpreter: “{{ ansible_playbook_python }}”
    personal_computers: locals # @NOTE can change to *_households group or {{ name }}_{{ surname }} group name
  vars_prompt:
    - name: gpg_import_passwords
      prompt: Enter space-wrapped colon -separated list of GPG private key passwords
      unsafe: yes
      private: yes
    - name: gpg_or_ssh_git_signing
      prompt: Enter preferred signing key type (e.g., ssh or gpg)
      unsafe: yes
      private: no
      default: "ssh"
    - name: gpg_preferred_signing
      prompt: Enter index or number of preferred signing key (negative number for random)
      unsafe: yes
      private: no
      default: -1
    - name: git_config_name
      prompt: Enter name for your git configuration
      unsafe: yes
      private: no
    - name: git_config_email
      prompt: Enter email for your git configuration
      unsafe: yes
      private: no
  tasks:
    - name: Disable shell access for root
      ansible.builtin.include_role:
        name: lockdown
        defaults_from: main
        vars_from: main
        handlers_from: main
        tasks_from: deshell
        apply:
          become: yes
      tags:
        - default
    - name: Create global bash aliases
      become: yes
      ansible.builtin.copy:
        src: files/all/bash/bash_aliases
        dest: /etc/bash_aliases
        owner: root
        group: root
        follow: yes
        force: yes
        backup: yes
        mode: "0644"
        state: present
      tags:
        - default
        - source_sys_bashrc
    - name: Create global bash functions
      become: yes
      ansible.builtin.copy:
        src: files/all/bash/bash_functions
        dest: /etc/bash_functions
        owner: root
        group: root
        follow: yes
        force: yes
        backup: yes
        mode: "0644"
        state: present
      tags:
        - default
        - source_sys_bashrc
    - name: Register bash aliases and functions to global bashrc
      become: yes
      ansible.builtin.blockinfile:
        block: |
          if [ -f /etc/bash_aliases ]; then
              . /etc/bash_aliases
          fi

          if [ -f /etc/bash_functions ]; then
              . /etc/bash_functions
          fi
        path: /etc/bash.bashrc
        prepend_newline: yes
        marker: "# {mark} ANSIBLE MANAGED SYSTEM-WIDE BASH ALIASES AND FUNCTIONS BLOCK"
        insertafter: EOF
        create: yes
        owner: root
        group: root
        backup: yes
        state: present
      tags:
        - default
        - source_sys_bashrc
    - name: Start XDG configuration tasks if in servers group 
      when: "'servers' in group_names and ansible_connection != 'local'"
      become: yes
      block:
        - name: Create XDG user home directory environment variables
          ansible.builtin.copy:
            src: files/servers/xdg/user-dirs.defaults
            dest: /etc/xdg/user-dirs.defaults
            owner: root
            group: root
            follow: yes
            force: yes
            backup: yes
            mode: "0644"
            state: present
        - name: Create XDG user home directory environment variables
          ansible.builtin.copy:
            src: "files/servers/{{ ansible_facts['user_id'] }}/xdg/user-dirs.dirs"
            dest: "{{ ansible_facts['user_dir'] }}/.config/user-dirs.dirs"
            owner: root
            group: root
            follow: yes
            force: yes
            backup: yes
            mode: "0644"
            state: present
      tags:
        - default
        - create_xdg_config
        - servers_exclusive
    - name: Start XDG configuration tasks if current host in specified group
      when: "personal_computers in group_names or ansible_connection == 'local'"
      become: yes
      block:
        - name: Create XDG user home directory environment variables
          ansible.builtin.copy:
            src: files/locals/xdg/user-dirs.defaults
            dest: /etc/xdg/user-dirs.defaults
            owner: root
            group: root
            follow: yes
            force: yes
            backup: yes
            mode: "0644"
            state: present
        - name: Create XDG user home directory environment variables
          ansible.builtin.copy:
            src: "files/locals/{{ ansible_facts['user_id'] }}/xdg/user-dirs.dirs"
            dest: "{{ ansible_facts['user_dir'] }}/.config/user-dirs.dirs"
            owner: root
            group: root
            follow: yes
            force: yes
            backup: yes
            mode: "0644"
            state: present
      tags:
        - default
        - create_xdg_config
        - locals_exclusive
    - name: Start SSH configuration tasks if current host in specified group
      when: "personal_computers in group_names or ansible_connection == 'local'"
      become: yes
      block:
        - name: Create user SSH configuration
          ansible.builtin.copy:
            src: "files/locals/ssh/{{ ansible_facts['user_id'] }}/config"
            dest: "{{ ansible_facts['user_dir'] }}/.ssh/config"
            follow: yes
            force: yes
            backup: yes
            owner: "{{ ansible_facts['user_id'] }}"
            group: "{{ ansible_facts['user_id'] }}"
            mode: "0600"
            state: present
      tags:
        - default
        - create_ssh_config
        - locals_exclusive
    - name: Import GPG private keys
      ansible.builtin.include_role:
        name: lockdown
        defaults_from: main
        vars_from: main
        handlers_from: main
        tasks_from: gpg
      vars:
        gpg_keys_origin_host: localhost
        gpg_origin_private_key_passwords: "{{ gpg_import_passwords | split(' : ') }}"
      tags:
        - default
        - import_gpg_privkeys
    # @TODO separate below task as lockdown role task, and maybe associated variables to lockdown role defaults/vars dirs
    # @NOTE below depends on variable 'gpg_signing_key' and 'gpg_or_ssh_git_signing' from 'vars_prompt' playbook field
    # @NOTE below depends on variable 'gpg_origin_private_keyids' and 'files_mode' found in lockdown role defaults/vars dirs
    - name: Install and configure git
      block:
        - name: Install git package
          ansible.builtin.package:
            name: git
            state: latest
        - name: Configure git installation
          block:
            - name: Configure git name
              community.general.git_config:
                name: user.name
                scope: global
                state: present
                value: "{{ git_config_name }}"
            - name: Configure git email
              community.general.git_config:
                name: user.email
                scope: global
                state: present
                value: "{{ git_config_email }}"
            - name: Configure git signing key
              block:
                - name: Configure git signing GPG key
                  when: gpg_or_ssh_git_signing == "gpg"
                  block:
                    - name: Configure specified git signing GPG key
                      when: gpg_preferred_signing > -1
                      community.general.git_config:
                        name: user.signingkey
                        scope: global
                        state: present
                        value: "{{ gpg_origin_private_keyids[gpg_preferred_signing] }}"
                    - name: Configure random git signing GPG key
                      when: gpg_preferred_signing <= -1
                      community.general.git_config:
                        name: user.signingkey
                        scope: global
                        state:  present
                        value: "{{ gpg_origin_private_keyids | random }}"
                      register: randomized_gpg_key_preference
                - name: Configure git signing SSH key
                  when: gpg_or_ssh_git_signing == "ssh"
                  block:
                    - name: Acquire SSH key-pairs from other system
                      when: not files_mode
                      block:
                        - name: Acquire private SSH keys from other system
                          delegate_to: "{{ ssh_keypairs_origin_host }}" # @TODO variable needs declaration/definition
                          ansible.builtin.command:
                            argv:
                              - cat
                              - ~/.ssh/"{{ item }}.ppk"
                          loop: "{{ ssh_origin_keypairs_paths }}" # @TODO variable needs declaration/definition--should have max 2 items each without file extension, with private and then public keys having same basename
                          register: ssh_secrets
                        - name: Find SSH public keys in other system
                          delegate_to: "{{ ssh_keypairs_origin_host }}" # @TODO variable needs declaration/definition
                          ansible.builtin.command:
                            argv:
                              - cat
                              - ~/.ssh/"{{ item }}.pub"
                          loop: "{{ ssh_origin_keypairs_paths }}" # @TODO variable needs declaration/definition--should have max 2 items each without file extension, with private and then public keys having same basename
                          register: ssh_nonsecrets
                        - name: Create private SSH keys
                          ansible.builtin.copy:
                            content: "{{ item }}"
                            dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.ppk"
                            force: yes
                            backup: yes
                            mode: "0600"
                            state: present
                          loop: "{{ ssh_secrets.results }}"
                          register: created_ssh_private_keys
                        - name: Create public SSH keys
                          ansible.builtin.copy:
                            content: "{{ item }}"
                            dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.pub"
                            force: yes
                            backup: yes
                            mode: "0644"
                            state: present
                          loop: "{{ ssh_nonsecrets.results }}"
                          register: created_ssh_public_keys
                    - name: Acquire SSH key-pairs
                      when: files_mode
                      block:
                        - name: Transfer private SSH keys
                          ansible.builtin.copy:
                            src: files/all/ssh/id_ed25519_git.ppk # @TODO change path if and when moved into lockdown role task file and create corresponding file in lockdown role files dir
                            dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.ppk"
                            force: yes
                            backup: yes
                            mode: "0600"
                            state: present
                          register: created_ssh_private_key
                        - name: Transfer public SSH keys
                          ansible.builtin.copy:
                            src: files/all/ssh/id_ed25519_git.pub # @TODO change path if and when moved into lockdown role task file and create corresponding file in lockdown role files dir
                            dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_git.pub"
                            force: yes
                            backup: yes
                            mode: "0644"
                            state: present
                          register: created_ssh_public_key
                    - name: Configure acquired, specified SSH public key as git signing key
                      when: ssh_preferred_signing > -1 and not files_mode
                      community.general.git_config:
                        name: user.signingkey
                        scope: global
                        state: present
                        value: "{{ created_ssh_public_keys.results[ssh_preferred_signing] }}" # @TODO this variable needs declaration/definition
                    - name: Configure acquired, random SSH public key as git signing key
                      when: ssh_preferred_signing <= -1 and not files_mode
                      community.general.git_config:
                        name: user.signingkey
                        scope: global
                        state: present
                        value: "{{ created_ssh_public_keys.results | random  }}" # @TODO this variable needs declaration/definition
                      register: randomized_ssh_pubkey_preference
                    - name: Configure transferred SSH public key as git signing key
                      when: ssh_preferred_signing <= -1 and files_mode
                      community.general.git_config:
                        name: user.signingkey
                        scope: global
                        state: present
                        value: "{{ created_ssh_public_key.dest }}"