---

- name: Initial Server Setup

  hosts: initial

  become: true

  vars_files:

    - ../user_vars.yml

  vars:

    password: Welcome1234

    ansible_managed: "This file is managed by Ansible. Do not modify."

  tasks:

    - name: Update + Upgrade packages

      ansible.builtin.apt:

        upgrade: true

        update_cache: true

      tags: basic

    - name: Install some basic packages

      ansible.builtin.apt:

        pkg:

          - sudo

          - git

          - vim

          - python3

          - python3-pip

      tags: basic

    # Change Hostname

    - name: "Update Hostnames"

      ansible.builtin.hostname:

        name: "{{ inventory_hostname }}"

      tags: hostname

    # Update /etc/hosts

    - name: Make sure an IPV4 entry in /etc/hosts exists

      ansible.builtin.lineinfile:

        path: /etc/hosts

        regexp: "^{{ ansible_default_ipv4.address }}"

        line: "{{ ansible_default_ipv4.address }} {{ inventory_hostname }} {{ inventory_hostname }}.freifunk.lu"

        state: present

      tags: network,hostname,dns

    - name: Make sure an IPV6 entry in /etc/hosts exists

      ansible.builtin.lineinfile:

        path: /etc/hosts

        regexp: "^{{ ansible_default_ipv6.address }}"

        line: "{{ ansible_default_ipv6.address }} {{ inventory_hostname }} {{ inventory_hostname }}.freifunk.lu"

        state: present

      tags: network,hostname,dns

    # SSH security improvements (EmptyPass, PassAuth, RootLogin)

    - name: Disable SSH Password Auth

      ansible.builtin.copy:

        dest: /etc/ssh/sshd_config.d/disable_password_auth.conf

        owner: root

        mode: u=rw,g=r,o=r

        content: |

          # {{ ansible_managed }}

          PasswordAuthentication no

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PasswordAuthentication"

        line: "# PasswordAuthentication No"

      tags: network,ssh

    - name: Disable SSH Empty Password

      ansible.builtin.copy:

        dest: /etc/ssh/sshd_config.d/disable_empty_password.conf

        owner: root

        mode: u=rw,g=r,o=r

        content: |

          # {{ ansible_managed }}

          PermitEmptyPasswords no

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PermitEmptyPasswords"

        line: "# PermitEmptyPasswords No"

      tags: network,ssh

    - name: Disable SSH Root Login

      ansible.builtin.copy:

        dest: /etc/ssh/sshd_config.d/disable_root_login.conf

        owner: root

        mode: u=rw,g=r,o=r

        content: |

          # {{ ansible_managed }}

          PermitRootLogin no

      ansible.builtin.lineinfile:

        path: /etc/ssh/sshd_config

        regex: "^PermitRootLogin"

        line: "# PermitRootLogin No"

      tags: network,ssh

    # Create Freifunk Users

    - name: Create member users

      ansible.builtin.user:

        name: "{{ item.username }}"

        password: "{{ password | password_hash('sha512') }}"

        update_password: "on_create"

        groups:

          - sudo

        append: true

        shell: /bin/bash

        state: present

      loop: "{{ users_member }}"

      tags: users

    - name: Create system users (no password)

      ansible.builtin.user:

        name: "{{ item.username }}"

        groups:

          - sudo

        append: true

        shell: /bin/bash

        state: present

      loop: "{{ users_system }}"

      tags: users

    - name: Add SSH key for users from vars

      ansible.posix.authorized_key:

        user: "{{ item.username }}"

        state: present

        key: "{{ lookup('file', item.key_path) }}"

      tags: users

      loop: "{{ users_member | union(users_system) }}"

    - name: Allow for password-less sudo

      community.general.sudoers:

        name: passwordless-sudo

        group: sudo

        commands: ALL

        nopassword: true