---
- name: "Include OS-specific variables"
  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] | lower }}.yml"

- name: "Ensure ssh package is installed"
  become: true
  ansible.builtin.package:
    name: "{{ ssh_package }}"
    state: "present"

- name: "Generate /etc/ssh/ RSA host key"
  become: true
  ansible.builtin.command:
    cmd: "ssh-keygen -q -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C '' -N ''"
    creates: "/etc/ssh/ssh_host_rsa_key"

- name: "Generate /etc/ssh/ ECDSA host key"
  become: true
  ansible.builtin.command:
    cmd: "ssh-keygen -q -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -C '' -N ''"
    creates: "/etc/ssh/ssh_host_ecdsa_key"

- name: "Generate /etc/ssh/ Ed25519 host key"
  become: true
  ansible.builtin.command:
    cmd: "ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C '' -N ''"
    creates: "/etc/ssh/ssh_host_ed25519_key"

- name: "Ensure ssh service is enabled"
  become: true
  ansible.builtin.service:
    name: "{{ ssh_service }}"
    state: "started"
    enabled: true
  when: not ansible_facts['is_chroot']

- name: "(chroot): Ensure ssh service is enabled"
  # noqa: command-instead-of-module intentional isnide chroot
  ansible.builtin.command:
    cmd: "systemctl enable {{ ssh_service }}"
  when: ansible_facts['is_chroot']
  changed_when: true

- name: "Configure sshd_config"
  become: true
  ansible.builtin.copy:
    dest: "/etc/ssh/sshd_config"
    mode: "0640"
    validate: "{{ 'sshd -T -f %s' if (not ansible_facts['is_chroot']) else omit }}"
    content: |
      KbdInteractiveAuthentication no   # default installation is no
      UsePAM no                         # default installation is yes
      PrintMotd yes                     # default installation is no

      # Host key configurations
      HostKey /etc/ssh/ssh_host_rsa_key
      HostKey /etc/ssh/ssh_host_ecdsa_key
      HostKey /etc/ssh/ssh_host_ed25519_key

      # Default sshd_config
      AuthorizedKeysFile    .ssh/authorized_keys
      Subsystem     sftp    /usr/lib/ssh/sftp-server
      Include /etc/ssh/sshd_config.d/*.conf
  notify:
    - "Reload systemd"
    - "Restart ssh"

- name: "Configure ssh authentication policy"
  become: true
  ansible.builtin.copy:
    dest: "/etc/ssh/sshd_config.d/99-auth-policy.conf"
    mode: "0640"
    validate: "{{ 'sshd -T -f %s' if (not ansible_facts['is_chroot']) else omit }}"
    content: |
      Port {{ ssh_port }}
      PasswordAuthentication no
      AuthenticationMethods publickey
      PermitRootLogin no
      PermitEmptyPasswords no
      ChallengeResponseAuthentication no
      X11Forwarding no
      StreamLocalBindUnlink yes
  notify:
    - "Restart ssh"

- name: "Add arg.username to allowed users"
  become: true
  ansible.builtin.copy:
    dest: "/etc/ssh/sshd_config.d/99-allowed-users.conf"
    mode: "0640"
    validate: "{{ 'sshd -T -f %s' if (not ansible_facts['is_chroot']) else omit }}"
    content: |
      AllowUsers {{ username }}
  notify:
    - "Restart ssh"

- name: "Configure known_hosts"
  ansible.builtin.known_hosts:
    name: "{{ item.split(' ') | first }}"
    key: "{{ item }}"
    path: "/home/{{ username }}/.ssh/known_hosts"
    state: present
  loop: "{{ ssh_known_hosts }}"
  when:
    - ssh_known_hosts is defined and ssh_known_hosts | length > 0
      # To ensure this is only run with user and not as a root
      # to avoid creating the file with the wrong permissions
    - not ansible_facts['is_chroot']