---
# Post-install bootstrap - Idempotent: safe to
# re-run against an already-bootstrapped host.

- name: Update apt cache and upgrade packages
  ansible.builtin.apt:
    update_cache: true
    upgrade: dist
    cache_valid_time: 3600

- name: Install Docker Engine and the Compose plugin
  ansible.builtin.apt:
    name:
      - docker.io
      - docker-compose-v2
    state: present

- name: Ensure Docker is enabled and running
  ansible.builtin.systemd:
    name: docker
    enabled: true
    state: started

- name: Create non-root sudo user, given the same key root was provisioned with
  ansible.builtin.user:
    name: "{{ deploy_user }}"
    shell: /bin/bash
    groups: sudo,docker
    append: true
    create_home: true

- name: Ensure deploy user's .ssh directory exists
  ansible.builtin.file:
    path: "/home/{{ deploy_user }}/.ssh"
    state: directory
    owner: "{{ deploy_user }}"
    group: "{{ deploy_user }}"
    mode: "0700"

- name: Give deploy user the same authorized_keys as root
  ansible.builtin.copy:
    src: /root/.ssh/authorized_keys
    dest: "/home/{{ deploy_user }}/.ssh/authorized_keys"
    remote_src: true
    owner: "{{ deploy_user }}"
    group: "{{ deploy_user }}"
    mode: "0600"

- name: Grant deploy user passwordless sudo
  ansible.builtin.copy:
    content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
    dest: "/etc/sudoers.d/90-{{ deploy_user }}"
    validate: "visudo -cf %s"
    mode: "0440"

# Root keeps key-only login as a fallback rather than being fully locked out,
# in case deploy user setup above ever fails silently on a future image.
- name: Restrict root login to key-only
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?PermitRootLogin"
    line: "PermitRootLogin prohibit-password"
  notify: Reload sshd

- name: Disable SSH password authentication
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^#?PasswordAuthentication"
    line: "PasswordAuthentication no"
  notify: Reload sshd

- name: Install unattended-upgrades
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present

- name: Enable automatic security upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
    mode: "0644"

- name: Enable and start unattended-upgrades
  ansible.builtin.systemd:
    name: unattended-upgrades
    enabled: true
    state: started