- name: add user xstill
  user:
    name: xstill
    uid: 22572
    group: users
    groups:
      - "{{'sudo' if debian else 'wheel'}}"
      - systemd-journal
    append: yes
    shell: /bin/bash
    create_home: yes

- name: SSH config dir (xstill)
  file:
    state: directory
    path: /home/xstill/.ssh
    owner: xstill
    group: users
    mode: 0700

- name: SSH authorized_keys (xstill)
  lineinfile:
    create: yes
    path: /home/xstill/.ssh/authorized_keys
    owner: xstill
    group: users
    regexp: '{{item.regexp}}'
    line: '{{item.line}}'
    state: '{{item.state|default("present")}}'
    insertafter: EOF
  with_items:
    - regexp: 'xstill@mail\.muni\.cz$'
      line: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFXnRpFOZQo3E6hK3adOfpRLegp/jwaHqKR+ReiSvl3cPaUhOCVzzP/BGxl115nH+23stXMdy4kUH8j9kzpYTJV0ADqVBz+1lyXD9JIHLQvKVexnvf6Wb26fMmLoOq2Z8PDvYYxMzpZ0L9qKJ6UcdGQyj1rGBGr4otHLC4I8FD/L7Yt4FtRNlMUz4Dj3nGGoz8fdu5iUqtgLZ4Kn25LtoeGY0oIFvUE0zwEtuaUYRbxrTtUsPyJ3pDPjFEKb40TB3dTLhp1Mnujvst40oigIJK6moOJRfQIANDtvJ1P1+XXHs26qoCE5ina5pBCe/Bl5QaPSDaXPgWP7dJAQUDYlh/ xstill@mail.muni.cz"
    - regexp: 'xstill@pythia01$'
      line: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/QqdQyYX/5OYO4jgEtmdiG6LKtS2YuJMp+/usxdWMi8XJPSBiPoxmAuMG/39bA3RWo7Pva9tG6Gei2pbDjceQjFuK10cq4eNtxvDBnXbshsgdTf+04O8G6JeNxtaX9K30qIhzJ+em8hHqU5xCCpn4bhFCD8pfWUyqxz+n8QsworlhONQfxy4mZ7R4Joj4T0keE5UrW+fROEPmf8x62hcEQLkhEUNUklkTCtMyBK0OaV1Wc2XT6/21dywTe6JZovgRiA0h8B/l1i7RgT+LscYsSBAVvXdr4qsFJoCqG8iLBQZnAwzvXnisneHyNCbIYb4iaYZtZHxgYTkHYH3dc4Hw9fVzZmhbP3oGfg0PGs95xNYCANFOHWBad3TIEBn5WuPyUgusOu61QvC2ZwKBhI5SszL0kWBogVmNWnh7n999YD3l8vKSpSnSGucu7mqsdU0DNP4uN2Vcz5JcdtCwpLgBMaGYaszj3QTh1v5QFRnyA250DahF8l7x+2wf02XHvWGa2LwOhKeX7QjLdE6XazFX7rFQ4pGqS/fS5Dn7tvJWaC6LX0JdxkmutxEk/8iuGRBrqU8Ape65PsL0NYrKaEVZXWr8SBFab1l5aJ3jcyFb+01VteDNilEj5O1aA1napT8OT4Km5d5jjnaSODYx/2mVA+BpbMhD7kOIbqxT01E+aQ== xstill@pythia01"
    - regexp: 'xstill@x270$'
      line: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/xGJUD1gA4fEFr90x0+QjqRT8HjHkSb4qNpmlBiJLuYtLll0laiNMTAZZynqC9O/g9w9aWEo659q0J4y58qOo5hi2ek16XoZWCSe+nkQiwdkGzOSH0eyCpsyyMfITDk6NnlJKi240k0WPu63eXkaXfshcwXhEleqP84OTXV/oc6OF2eJeyqe4G8gpuwRpbPGazjVFhtSbrWPvpU2WbAB8X9VuTTQGuFum5OPtYN2qXEtVbvy1BvjK1J9tNtEiVcXt3BMJTjEBhuKMMEo29LQgO+S8/GbEskZpygNyi7lEbewWVCW1fdsRzdUF+alwlEgDNCbgDo9iefaE8taiNKk0CM3cNPJNTD+WKhvzhwH3ldYjT1O5HMcQRBRAHF8JpLsHnj8iuDSSElvktdoz2cxOZo0PZVJo9rh2EikIE/0MGjTM/txkWGbD+HrvE/IGxoe6QGxx4uBqfZQ1PpOSFqR80juuJFDXi/MZp08ndQAaH2LafhGhAMCITp/R655I9bqKFTvzftHHQdnNvQr1wLDKcxm+H0DeqYCH0vA1YpetE7rGtZXrSqtyqlpsLh6rxbaKUkqj2hzm3XzE+z3o4Bv5oRbmyDqR+i00pyd80LF1LD5cBvo+0/d3q2KlYOMM1MmJSZ13RjhbGZ4pc9Q2wJH51THWfFMSAknLdbPLR87yKQ== xstill@x270"
    - regexp: 'xstill@t14.p.vstill.cz'
      line: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDFz70Qud3kVM2rgeItW6A5deQhUME6pBUcVMvXWVz4zVqXOybqVB13p1RqlYwDf5IV/Tcc7Mb72ik4U3727659yLaNgR1cSMIBOEAPUSYqc1sjc/fO2N6XX1H48jROCFpfvc3BjIIm6vgSE4ZgOlQj8b4VmSNMkM9ThIlaaFRg7p/N9lyAXDqKvHrAZVV3NaSpIuoLdt3Zxiek/qK30lBJ2kEHQ4rP1RB+H+NTd5H39willDVVsV5BtLBr2wFLJ0qZaPaRw/5w5H+DQC2WFYninOkER5cwgnWqU4/AshVyr9IyKqo3lheWn7sq6CY+CCnXJ0IddP2HJSPeI0so6bX+Y4U9GOpyfJMyK/3tw/mnvBCQJ/AqvCri2iwBPZqDkVqvibCuuK/HSR3a8DIlTBfuqPK5RWluuapFKsRwueZtJkqxQNdpxpN5/CU4ZSVpj6wowYJK/g6AsvIAOeA+UxzgaI8TZjCDSe3stL0Dawaz5hS90Pg/hHVv8pNBolZzll8= xstill@t14.p.vstill.cz'

- name: Add apt-key for Syncthing
  apt_key:
    data: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
        Version: GnuPG v1

        mQENBFShFd8BCADHQq9byO6uehb51iieKKi2KEwudhkbV74r8ZsGp0Q3asmv6cPl
        EFLKXCs9vm9f0Qn58up44ikd/782Gu7CQoFBM/DGj1SGXpWRj7fd6nnErA5JUiUz
        hpYN/Py0XWSApZE0xXUhBnd1UM1ymnWjGxu6HYb2ZIayr3jisZmUOVIwHJToqjIK
        grjt9afTlvDOfBN5GBeLYetByvza3JGt9kwn9z1ryhssyVHur+uXvJq7CuXJzImU
        E4QW9fwjeOHFFBQevYMVHhnlVgXGQ/fNmYW+MeXG4GE8viyRuv0asRwMjp+1zpP1
        EvAM/Z8Y9Udv1DvSTjonET3G9fOyNfU3HNcvABEBAAG0NFN5bmN0aGluZyBSZWxl
        YXNlIE1hbmFnZW1lbnQgPHJlbGVhc2VAc3luY3RoaW5nLm5ldD6JATgEEwECACIF
        AlShFd8CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENJubtAAZUo+XrsI
        AKk9Usgg6R/6/tfohdTjV9gpeMn+BpvP5boTAEWdTDF0azg06aAt0engrVkbwG70
        Nf9KKbDcSDZUJs1kZVq1TJvo3JnR+Dw0a9AcEvY+zDRcGuHmIjdei5QtaMsVB+8b
        zR0muX1YRw0MhncHg4bvEzWdrWRHZr71trVKTm2v/xW2Bd1KJmzUv/D2DjML3NL7
        SkbZMHmqTWE9jNoSajlxdIsZRM0QbzREEkC95/INaZvK1n8jY1fobY5qAx2knzp6
        SLx8TamN8RcACAhkV43NnFCdb3hhE6W22xK7BFwDSvoUvm+xi9NJWLg6UWPVSAPt
        6Eb/RdtUlXx05awR6HzN/dSJAhwEEAECAAYFAlShFe0ACgkQSfWuwLzlJMdzHw/9
        EIDBnOTJdCzQ7GTUZjUQbdw2l3amgIvJiIFVwj3vzNIVLAOcCAej3jBiZpUw9B/2
        Omz3Y3qMeb4U0QP5EpBPCNmkViZ/Hvg9R5axWobnvsXTyxTMBJqL7IJ4W4PrKoeI
        W3ijNtj5b5k4+DpMKtmZ7I1u2x5CSek6vzDxRxaqpLIJFpdUGRBKfeVxmb2QQbIq
        QmDBZGEaK5ICfFegNGYZdyVqg7F/tr3mMOOWnuO1aFhqHQOjtZmG4TfpjrdrLZ2M
        4qbRf0MD6dkOnthGvZXtY6Bx7grXqmtkT598+YRm3YK49KvCiAOpi9nCxPl3JJ0V
        z9MaWx2Y8ODzN/sOYos6PxnPdlP3xVSCOyxdegjqbo9IQweg3EcuVzkyhFWdIOix
        A5qh28E1Wun+wI1R0E9vfSFXXvVJeSQ/Whk+fGDKEkJxip/IoCo141DNKj/wJ3xS
        s03vTqtTwN/uPdIsCbWRSqG6mL1AOgi66NfFiT6Wu5ru/F+6p0XPJD5AL3mF4hyF
        hAtA/oKAYGs6FWHo+6bm5BBuklSQMJbCt8/T4LE/QWFKtJLMenOICArwBwqSo8WX
        NjyLjnRdQpMTUuKG36JSyMWdLmMq4FBSICjkOKOR/4RCmIR+hL4m4lfjc/FEyMe0
        jKAx8Nu4wzpoqUHygsljwEjmfzDdJ7S2MRG00EHzu7e5AQ0EVKEV3wEIALMoAN+6
        C5hgi70ICFl60YnHx/C8CkeW7+KVoog/iXLLTX8o6JYODLBn0kW8OxrRLCbNKNev
        lJYR1czjcpmdO+k8vyXOt0qj95kak+nrjzlxJ/YJh2f5JAgqkkkwZBc4qrzcc8Ek
        Y/rH9Z/JovOi55g0f8X2uQLRqQPq5a41Jgo94H3KjM42dhkNwSKBucesTLn3BOdQ
        gERjzqy4NCF06R3GaGM9Nt2fQ3uwmAsyxBU9YtHsyxK0zLSKQD79oe3e8S4DVZ7x
        3KhxdP7uEypNpsR86IS9v4Y3UGhLbbmL2VQSOkr5bK6to/PHzfMo+WrLToR57Tl7
        w4ZtV0a+uJAyhAUAEQEAAYkBHwQYAQIACQUCVKEV3wIbDAAKCRDSbm7QAGVKPlSH
        CAC/oflzvJvTKY5JlYAI694Fqtzqg4Z36ymUq43G2jqI+/HYcRM+Lnj52+rwpY6C
        QU4shli/cwVJRLzkC+8pB6dzIqX1eKqD2RYmEDLeixibY9TwnPOKtMytW6dTRIxa
        7+H6tO+n+9tT5JWIqKoP4kWFUBHKT7RBI3ubFxwaGwV1IGpItvukOa4XbDAWR3Ya
        TL+fbNhHegwae/3xX+T4+Ik40UnFtrJiHkbu3RmEzO38n5xJY+hG/lHQrsErQAUa
        kEEm5vqw/veVl3L88VnOWHhD3GxvPvtuN/RTxmwhlQ9rte/G6U/R0HDYFqrHDAns
        LlHRAP8U8Ozk3ll45SR12Zf2
        =rVev
        -----END PGP PUBLIC KEY BLOCK-----
  when: debian and upstream_syncthing

- name: Syncthing apt source
  apt_repository:
    repo: deb https://apt.syncthing.net/ syncthing stable
    filename: syncthing
    state: present
  when: debian and upstream_syncthing

- name: install syncthing from upstream (Debian)
  apt:
    pkg:
      - syncthing
    default_release: syncthing
    state: latest
  when: debian and upstream_syncthing

- name: install syncthing (Archlinux)
  pacman:
    pkg:
      - syncthing
  when: not debian

- name: install syncthing from distro repos (Debian)
  apt:
    pkg:
      - syncthing
  when: debian and not upstream_syncthing

- name: enable syncthing for xstill
  systemd:
    enabled: yes
    name: syncthing@xstill
    state: started

- name: Notify watches
  sysctl:
    # up to 256 MB kernel memory on 32bit sys, 512MB on 64bit
    # this is the default on Archlinux (2021)
    name: 'fs.inotify.max_user_watches'
    value: '524288'
    sysctl_file: "/etc/sysctl.d/31-notify-watches.conf"

- name: install openvpn (Debian)
  apt:
    pkg:
     - openvpn
  when: debian


- name: install openvpn (Archlinux)
  pacman:
    pkg:
     - openvpn
  when: not debian


- name: install FI-split openvpn config
  copy:
    src: fi-split.ovpn
    dest: /etc/openvpn/client/fi-split.conf

- name: point FI-split openvpn to password (which should be created manually)
  lineinfile:
    path: /etc/openvpn/client/fi-split.conf
    line: "auth-user-pass /etc/openvpn/auth/fi-split.secret"
    regex: "^auth-user-pass "
    insertafter: "^auth-nocache"

- name: start openvpn FI-split
  systemd:
    enabled: yes
    state: started
    name: openvpn-client@fi-split
  when: openvpn_fi_start

# vim: shiftwidth=2 tabstop=2 softtabstop=2 ft=yaml.ansible
