- name: "Apt sources list"
  copy:
    dest: /etc/apt/sources.list
    # nb. single newlines are remove by ansible :-/
    content:
      deb http://ftp.fi.muni.cz/pub/linux/debian/ bullseye main contrib non-free

      deb-src http://ftp.fi.muni.cz/pub/linux/debian/ bullseye main contrib non-free


      deb http://security.debian.org/ bullseye-security main contrib non-free

      deb-src http://security.debian.org/ bullseye-security main contrib non-free
  register: apt_sources

- name: "Update apt cache after source update"
  apt:
    update_cache: true
  when: apt_sources.changed

- name: Create /var/obj
  file:
    state: directory
    path: /var/obj
    mode: 01777

- name: SSH authorized_keys (root)
  lineinfile:
    create: yes
    path: /root/.ssh/authorized_keys
    owner: root
    group: root
    regexp: '{{item.regexp}}'
    line: '{{item.line}}'
    state: '{{item.state|default("present")}}'
    insertafter: EOF
  with_items:
    - regexp: 'xstill@xstill-lenovo$'
      line: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyTqSTbfhzJUlAV3/WQPefOz/nX0xfGgBbb9mMxwXNm3OKpTLaSJZZ78aUvucCqbiWhWQKCKlUqMsaWCqHLIL5kFDgDRcfGhF8ERCjIG7TCPs1zPPoFVL8hvGeMmWsHgvm8pKjPFCp/NxjTDx3RmLzVyP1z8rLwD3X1xC2bRSETuRwwOIKLEJhzNSQ1EchTNRTH0CuMqVZHdQLVDP6Tdqo7WV61znELRW5ZPw7BPJU216+He7AziIGcLbv06JbuFyFsoZ+8dmH20rs/CwOnicFH/P44yOZmB+JWVzBosKkG8JliM/nzaru7aPPQe/7XIsOQ5iymm31WAK112htIy3N xstill@xstill-lenovo'

    - regexp: 'mornfall@oak.fixp.eu$'
      line: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+QGySGvuDPKSA4zcg/WZAx+WpxityRFt7ejd/tbwAcpQ7C5Y+SoUdhqG8LaOO2rP5M/n8IQO23BPFNTH1sgIdgPAyc9dj9J9oMMrZqOt+3JEwU9TWrSBEJzfLZZx200ft9KwIJu+rSKpvOy+ePsBxMAfdslW48aNj6wBKuxezj55GOYko9GmToA4o3nk65GjVreh6z2mzKqZFZ5wUB1SBd3qQz8k26fuQpDPRTfgivp0IL0GPBwcKCZEwrsBxUdu9JOhiu8B9b2I7zD8gHKbDyp+XEjGAIs6Pta4Ib58go/ufpNl/L4rsqpytGJXnkHGuqnnTtRHxF+0wpaT/N+aB mornfall@oak.fixp.eu'

    - regexp: 'mornfall@magnolia.fixp.eu$'
      line: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzCmaR3dDl3mjO9u1MFsToxRIrTLiIc5aKBBrFZ4srvaptvPDr1sw570G6ZXH212/NlGTMWh1cRH1YhoMUxejKzcJx8Gub3LvJZVEANsE7s4pWP21GvaI0ZIymWReqtb3lP/6+hkFSrpir17hor6VjRymbGfkATD+4fE3yK0Qk1c16G0+1/n1JXOSwG65xzCq+EA12ReQzE4XAofk0nkaUT2xCV1xOE04XgW84AfrJq3HIuZctLs6/FqecJGC/6NO6QVVza5YQNGzEPlag0tqCFUFgfjLB9ggnxqxaU3P8dbKudsH7giZDzJXgyCA2frY6SM2XF4o+tAjZRtHI8zlh mornfall@magnolia.fixp.eu'

    - regexp: 'xkonicar@fi$'
      line: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIINb6K2zbFgUbFlKHD7mRzWAzNU1sCc2a9sJiZuW7OSA xkonicar@fi'

- name: "Shells & utils"
  apt:
    pkg:
      - ldap-utils  # ldapsearch
      - zsh
      - fish

- name: "Install CUPS"
  apt:
    pkg:
      - cups
      - cups-bsd  # lpr

- name: "Set CUPS server"
  lineinfile:
    insertafter: EOF
    regexp: "^CUPS_SERVER="
    line: "CUPS_SERVER=print.fi.muni.cz"
    path: /etc/environment

- name: NSSwitch LDAP prerequisites
  apt:
    pkg:
      - nscd
      - libnss-ldap

- name: FI_CA (LDAP) dir
  file:
    path: /etc/ldap/ssl/
    state: directory

- name: FI_CA (LDAP)
  copy:
    src: FI_CA.pem
    dest: /etc/ldap/ssl/FI_CA.pem

- name: LDAP config for NSSwitch
  copy:
    src: '{{item}}'
    dest: '/etc/{{item}}'
  loop:
    - libnss-ldap.conf
  notify:
    - restart nscd

- name: NSSwitch LDAP
  lineinfile:
    regexp: '^({{item.0}}):(\s+)'
    line: '\1:\2{{item.1}}'
    backrefs: true
    path: /etc/nsswitch.conf
  loop:
    - ['passwd', 'files systemd ldap']
    - ['group', 'files systemd ldap']
    - ['shadow', 'files ldap']
  notify:
    - restart nscd

# - name: "Does legacy ParaDiSe group exist?"
#   group:
#     name: paradise
#     state: present
#   check_mode: true
#   register: paradise_legacy_group

# - name: "Rename ParaDiSe legacy group"
#   lineinfile:
#     path: '{{item}}'
#     regexp: '^paradise:(.*)$'
#     line: 'student:\1'
#     backrefs: true
#   loop:
#     - /etc/group
#     - /etc/gshadow
#   when: not paradise_legacy_group.changed and paradise_legacy_group.gid == 10100

# - name: "Local copy of relevant FI groups"
#   group:
#     name: '{{item.name}}'
#     gid: '{{item.gid}}'
#   loop:
#     - name: student
#       gid: 10100
#     - name: staff
#       gid: 10000
#     - name: paradise
#       gid: 10240

- name: known_hosts update script
  copy:
    src: ../bin/get_ssh_hosts
    dest: /usr/sbin
    mode: a=rx

- name: known_hosts update service files
  copy:
    src: '{{item}}'
    dest: '/etc/systemd/system/{{item}}'
  register: known_hosts_service
  loop:
    - known_hosts.service
    - known_hosts.timer

- name: known_hosts update timer
  systemd:
    name: known_hosts.timer
    enabled: true

- name: update known_hosts_service (oneshot)
  systemd:
    name: known_hosts.service
    daemon_reload: true
    state: started
  when: known_hosts_service.changed

- name: "sudo for ParaDiSe roots"
  lineinfile:
    path: /etc/group
    regexp: '^(sudo:[^:]*:[^:]*:):*[^:]*$'
    line: '\1xstill,xbarnat,xrockai'
    backrefs: true

- name: "Dev tools"
  apt:
    pkg:
      - make
      - bmake
      - python3
      - cmake
      - ninja-build
      - gcc
      - g++
      - git
      - darcs
      - subversion
      - mercurial

- name: "RoFI dependencies"
  apt:
    pkg:
      - libarmadillo-dev
      - libvtk7-dev
      - libvtk7-qt-dev
      - qtdeclarative5-dev
      - libgazebo9-dev
      - z3
      - libz3-dev
      - doxygen
      - graphviz
      - python3-sphinx
      - python3-breathe
      - python3-sphinx-rtd-theme
      - python3-recommonmark
      - gcc-arm-none-eabi

- name: "Misc usefull programs"
  apt:
    pkg:
      - irssi

- name: "Stop various user-level systemd services we do not want"
  systemd:
    scope: 'global'
    name: "{{item}}"
    state: "stopped"
  failed_when: false  # ignore failure
  loop: "{{masked}}"

- name: "Block various user-level systemd services we do not want"
  file:
    src: "/dev/null"
    dest: "/etc/systemd/user/{{item}}"
    follow: false
    state: link
  loop: "{{masked}}"

- name: "Disable benchexec-cgroup.service"
  systemd:
    name: "benchexec-cgroup.service"
    enabled: false
    state: stopped

- name: "Additional systemd dependencies"
  block:
    - name: "Add drop-in directories"
      file:
        state: "directory"
        path: "/etc/systemd/system/{{item.service}}.d/"
      loop: "{{deps}}"

    - name: "Add systemd dependencies"
      copy:
        content: "[Unit]\nAfter={{item.after | join(' ')}}\n"
        dest: "/etc/systemd/system/{{item.service}}.d/deps.conf"
      loop: "{{deps}}"
  vars:  # no loop for block, so loop in each task separately
    deps:
      - service: "network.target"
        after: ["dhcpcd.service"]
      - service: "cron.service"
        after: ["network-online.target", "autofs.service", "postfix.service"]
