# Runs as the installer's desktop user until root is reachable with a key,
# then switches over and strips that user of its admin rights.
- name: Authorize the SSH key for root
  become: true
  ansible.posix.authorized_key:
    user: root
    key: "{{ lookup('ansible.builtin.file', install_ssh_keys__ssh_pubkey_path | expanduser) }}"

# Empty passwords make Ansible skip sshpass and fall back to the key.
- name: Switch the connection to root
  ansible.builtin.set_fact:
    ansible_user: root
    ansible_ssh_pass: ''
    ansible_become_password: ''

- name: Drop the desktop user connection
  ansible.builtin.meta: reset_connection

# Arch already allows root logins with a key. Stop here, with sshd and the
# desktop user untouched, if root can't get in.
- name: Check root login
  ansible.builtin.ping:

- name: Deploy the sshd configuration
  ansible.builtin.template:
    src: sshd.conf.j2
    dest: /etc/ssh/sshd_config.d/01-bc250.conf
    mode: '0644'
  notify: Reload sshd

- name: Validate the sshd configuration
  ansible.builtin.command:
    argv:
      - sshd
      - -t
  changed_when: false

- name: Apply the sshd configuration
  ansible.builtin.meta: flush_handlers

- name: Grant the desktop user the udisks actions Steam needs
  ansible.builtin.template:
    src: deck.rules.j2
    dest: /etc/polkit-1/rules.d/50-bc250-{{ users__desktop_user }}.rules
    mode: '0644'

- name: Read the group database
  ansible.builtin.getent:
    database: group

- name: Remove the desktop user from the admin groups
  ansible.builtin.user:
    name: "{{ users__desktop_user }}"
    groups: >-
      {{ ansible_facts.getent_group | dict2items
         | selectattr('value.2', 'search', '(^|,)' ~ users__desktop_user ~ '(,|$)')
         | map(attribute='key')
         | difference(users__admin_groups) }}
    append: false

# '!' with no hash: password logins are impossible, SDDM autologin still works.
- name: Remove and lock the desktop user password
  ansible.builtin.user:
    name: "{{ users__desktop_user }}"
    password: '!'