---
- name: setup target to be managed by ansible
  hosts: cibles
  vars:
      password: "{{lookup( 'viczem.keepass.keepass', 'ansible shell', 'password') }}"
      username: "{{ lookup( 'viczem.keepass.keepass', 'ansible shell', 'username') }}"
  tasks:
  - name: warn people
    lineinfile:
      path: /etc/motd
      create: yes
      line: "Host is managed by ansible, manual interaction not recommended"
      state: present

  - name: history
    lineinfile:
      path: /etc/history
      line: "{{ '%Y-%m-%d' | strftime }} - {{ ansible_play_name }}"
      state: present
      create: true

  - name: generate ssh keys
    openssh_keypair:
      path: "~/.ssh/id_rsa"
      size: 2048
    delegate_to: localhost
    become: false

  - name: create account
    tags: lookup
    vars:
    user:
      name: "{{ username }}"
      password: "{{  password  | password_hash('sha512',65534|random(seed=inventory_hostname) | string) }}"
      create_home: yes
      home: "/home/{{ username }}"

  - name: configure sudo
    copy:
      content: "{{ username }} ALL=(ALL)      NOPASSWD:  ALL"
      dest: /etc/sudoers.d/ansible
      validate: "/usr/sbin/visudo -cf %s"

  - name: deploy ssh key
    authorized_key:
      user: "{{ username }}"
      key: "{{ item }}"
    loop:
    - "{{ lookup( 'file', '~/.ssh/id_rsa.pub' ) }}"
    - "https://infra.opendoor.fr/id_rsa.pub"