---
- name: "Bootstrap"
  hosts: "archlinux"
  gather_facts: true
  environment:
    PATH: "{{ ansible_env.HOME }}/.local/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_become_method: su
    user_public_keys:
      - "ssh-ed25519 AAAA...fMo"
      - "ssh-rsa AAAA...4I3"
    user_groups: ["wheel", "test_group"]
  roles:
    - role: "hostname"
    - role: "network"
    - role: "user"
    - role: "ssh"
    - role: "password_policy"
  pre_tasks:
    - name: "Update package cache"
      become: true
      ansible.builtin.package:
        update_cache: true
      async: 60
      poll: 5
      failed_when: false
  tasks:
    - name: "Configure passwordless sudo for testing"
      ansible.builtin.copy:
        content: "%test_group ALL=(ALL) NOPASSWD: ALL\n"
        dest: "/etc/sudoers.d/test_group"
        mode: "0440"
        validate: 'visudo -cf %s'

- name: "Configure"
  hosts: "archlinux"
  gather_facts: true
  remote_user: "{{ username }}"
  environment:
    PATH: "{{ ansible_env.HOME }}/.local/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_become_method: sudo
    locales:
      - "en_US.UTF-8 UTF-8"
    timezone: "GMT"
    wireguard_autostart_connection: ""
    gateway_enabled: true
    gateway_local_ipv4_subnet: "10.0.0.0/24"
    python_global_version: "3.13"
    python_versions:
      - "3.13"
    vimrc_repo_url: "https://git.sr.ht/~a14m/.vim"
    password_store_repo_url: "https://github.com/octocat/Spoon-Knife"
    firefox_install_browserpass: true
    firefox_install_passff: true
  pre_tasks:
    - name: "Override is_chroot fact for container environment"
      ansible.builtin.set_fact:
        ansible_facts: "{{ ansible_facts | combine({'is_chroot': false}) }}"
  roles:
    - role: "locales"
    - role: "timezone"
    - role: "bash"
    - role: "man"
    - role: "jq"
    - role: "ag"
    - role: "tmux"
    - role: "yay"
    - role: "wireguard"
    - role: "gateway"
    - role: "python"
    - role: "go"
    - role: "rust"
    - role: "zoxide"
    - role: "docker"
    - role: "podman"
    - role: "ansible"
    - role: "nginx"
    - role: "prometheus"
    - role: "grafana"
    - role: "rsync"
    - role: "gpg"
    - role: "dotfiles"
    - role: "vim"
    - role: "neomutt"
    - role: "password_store"
    - role: "which"
    - role: "firefox"
    - role: "chromium"
    - role: "obsidian"
    - role: "font"
    - role: "aur_font"
    - role: "alacritty"
    - role: "mpv"
    - role: "btop"
    - role: "bluetui"
    - role: "wlctl"
    - role: "pipewire"
    - role: "brightnessctl"
    - role: "wiremix"
    - role: "nvidia_gtx1060"
    - role: "hyprland"
    - role: "claude"