---
- name: "Install packages"
  become: true
  ansible.builtin.package:
    name:
      - cgit
      - lighttpd
      - openssh
    state: present

- name: "Create git group"
  become: true
  ansible.builtin.group:
    name: "{{ cgit_ssh_user }}"
    system: true

- name: "Create git user"
  become: true
  ansible.builtin.user:
    name: "{{ cgit_ssh_user }}"
    group: "{{ cgit_ssh_user }}"
    shell: "/usr/bin/git-shell"
    home: "{{ cgit_repos_dir }}"
    create_home: true
    system: true
    password: "*"

- name: "Set default branch name for new repos"
  become: true
  community.general.git_config:
    name: init.defaultBranch
    scope: system
    value: main

- name: "Ensure sshd_config restricts login to expected users"
  become: true
  ansible.builtin.lineinfile:
    path: "/etc/ssh/sshd_config"
    regexp: "^AllowUsers "
    line: "AllowUsers root {{ cgit_ssh_user }}"
    validate: "sshd -T -f %s"
  notify: "Restart sshd"

- name: "Deploy authorized_keys"
  become: true
  ansible.posix.authorized_key:
    user: "{{ cgit_ssh_user }}"
    key: "{{ item }}"
    path: "/etc/ssh/authorized_keys/{{ cgit_ssh_user }}"
    state: present
  loop: "{{ user_public_keys }}"

- name: "Configure sshd AuthorizedKeysFile for {{ cgit_ssh_user }}"
  become: true
  ansible.builtin.blockinfile:
    path: "/etc/ssh/sshd_config"
    marker: "# {mark} ANSIBLE {{ cgit_ssh_user }} MATCH BLOCK"
    validate: "sshd -T -f %s"
    block: |
      Match User {{ cgit_ssh_user }}
          AuthorizedKeysFile /etc/ssh/authorized_keys/%u
          AllowTcpForwarding no
          AllowAgentForwarding no
          PermitTTY no
  notify: "Restart sshd"

- name: "Create repos directory"
  become: true
  ansible.builtin.file:
    path: "{{ cgit_repos_dir }}"
    state: directory
    owner: "{{ cgit_ssh_user }}"
    group: "{{ cgit_ssh_user }}"
    mode: "2755"

- name: "Deploy cgitrc"
  become: true
  ansible.builtin.template:
    src: "cgitrc.j2"
    dest: "/etc/cgitrc"
    owner: "root"
    group: "root"
    mode: "0644"

- name: "Deploy lighttpd config"
  become: true
  ansible.builtin.template:
    src: "cgit.lighttpd.conf.j2"
    dest: "/etc/lighttpd/lighttpd.conf"
    owner: "root"
    group: "root"
    mode: "0644"
  notify: "Restart lighttpd"

- name: "Enable and start services"
  become: true
  ansible.builtin.service:
    name: "{{ item }}"
    enabled: true
    state: started
  loop:
    - lighttpd
    - sshd