---
# Create the administrative user, install its SSH key, enforce password
# policy, and lock the root account.

- name: Create the administrative user
  ansible.builtin.user:
    name: "{{ admin_user }}"
    groups: wheel
    append: true
    create_home: true
    home: "/home/{{ admin_user }}"
    shell: /bin/bash
    comment: "Minecraft server administrator"
    password: "{{ admin_user_password_hash | default('!') }}"
    password_expire_max: "{{ auth_password_max_days }}"
    password_expire_min: "{{ auth_password_min_days }}"
    state: present

- name: Install the admin user's SSH public key
  ansible.builtin.authorized_key:
    user: "{{ admin_user }}"
    state: present
    key: "{{ admin_user_ssh_key }}"
  when: admin_user_ssh_key | length > 0

- name: Allow the admin user passwordless sudo
  ansible.builtin.copy:
    content: "{{ admin_user }} ALL=(ALL) NOPASSWD: ALL\n"
    dest: "/etc/sudoers.d/{{ admin_user }}"
    owner: root
    group: root
    mode: "0440"
    validate: /usr/sbin/visudo -cf %s

- name: Enforce password complexity settings
  ansible.builtin.lineinfile:
    path: /etc/security/pwquality.conf
    regexp: '^#?\s*{{ item.key }}\s*='
    line: "{{ item.key }} = {{ item.value }}"
  loop:
    - { key: minlen, value: "{{ auth_minlen }}" }
    - { key: dcredit, value: "{{ auth_dcredit }}" }
    - { key: ucredit, value: "{{ auth_ucredit }}" }
    - { key: lcredit, value: "{{ auth_lcredit }}" }
    - { key: ocredit, value: "{{ auth_ocredit }}" }

- name: Enforce global password aging defaults
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: '^PASS_MAX_DAYS\s+'
    line: "PASS_MAX_DAYS {{ auth_password_max_days }}"

- name: Enforce minimum days between password changes
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: '^PASS_MIN_DAYS\s+'
    line: "PASS_MIN_DAYS {{ auth_password_min_days }}"

- name: Enforce password change warning
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: '^PASS_WARN_AGE\s+'
    line: "PASS_WARN_AGE {{ auth_password_warn_age }}"

- name: Lock the root account's password
  ansible.builtin.user:
    name: root
    password: '!'
    state: present
  when: auth_lock_root_password | bool