---
- name: "Set user groups fact"
  ansible.builtin.set_fact:
    user_groups: "{{ ([username, 'sudo'] + user_groups) | unique }}"

- name: "Ensure user groups are created"
  become: true
  ansible.builtin.group:
    name: "{{ item }}"
    state: "present"
  loop: "{{ user_groups }}"

- name: "Create user"
  # noqa var-naming[no-role-prefix] username is more understandable than user_name
  become: true
  ansible.builtin.user:
    name: "{{ username }}"
    append: true
    create_home: true
    generate_ssh_key: false
    groups: "{{ user_groups }}"
    password: "{{ user_password | default(user_default_password) }}"
    shell: "/bin/bash"
    state: "present"
    update_password: "on_create"
  register: user
  notify: "{{ [] if user_password is defined else ['Require password change'] }}"
  no_log: true

- name: "Create user ssh directory"
  ansible.builtin.file:
    path: "/home/{{ username }}/.ssh/"
    mode: "0700"
    owner: "{{ username }}"
    state: "directory"

- name: "Add user ssh authorized_keys"
  ansible.builtin.copy:
    dest: "/home/{{ username }}/.ssh/authorized_keys"
    mode: "0600"
    owner: "{{ username }}"
    content: |
      {{ user_public_keys | join('\n') }}

- name: "Enable lingering for user systemd instance"
  become: true
  ansible.builtin.file:
    path: "/var/lib/systemd/linger/{{ username }}"
    state: "touch"
    modification_time: "preserve"
    access_time: "preserve"
    mode: "0644"
  when: not ansible_facts['is_chroot']

- name: "Start user systemd instance"
  become: true
  ansible.builtin.systemd_service:
    name: "user@{{ user.uid }}.service"
    state: "started"
  when: not ansible_facts['is_chroot']