- name: Init Debian
  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
  block:
    - name: Ensure required packages are installed
      ansible.builtin.apt:
        name:
          - gpg
          - wget
          - lsb-release
        state: present
        update_cache: true

    - name: Download HashiCorp GPG key
      ansible.builtin.get_url:
        url: https://apt.releases.hashicorp.com/gpg
        dest: /tmp/hashicorp.gpg
        mode: '0644'

    - name: Convert HashiCorp GPG key to keyring format
      ansible.builtin.command:
        cmd: >
          gpg --dearmor
          -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
          /tmp/hashicorp.gpg
      args:
        creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg

    - name: Add HashiCorp repository
      ansible.builtin.apt_repository:
        repo: >-
          deb [arch={{ (ansible_architecture == 'x86_64')
          | ternary('amd64', ansible_architecture) }}
          signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
          https://apt.releases.hashicorp.com
          {{ ansible_distribution_release }}
          main
        filename: hashicorp
        state: present

    - name: Update apt cache
      ansible.builtin.apt:
        update_cache: true

    - name: Install Vault
      ansible.builtin.apt:
        name: vault
        state: present


    - name: Set vault address
      copy:
        dest: /etc/profile.d/vault.sh
        content: "export VAULT_ADDR=http://vault.home.lan:8205\n"
        owner: root
        group: root
        mode: '0644'

    - name: Read SSH CA public key from Vault
      ansible.builtin.command:
        cmd: vault read -field=public_key ssh/config/ca
      register: vault_ca
      changed_when: false
      environment:
        VAULT_ADDR: "{{ vault_addr }}"
        VAULT_TOKEN: "{{ vault_token }}"

    - name: Install trusted SSH user CA
      ansible.builtin.copy:
        content: "{{ vault_ca.stdout }}\n"
        dest: /etc/ssh/trusted-user-ca-keys.pem
        owner: root
        group: root
        mode: '0644'

    - name: Enable Trusted User CA
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^TrustedUserCAKeys"
        line: "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem"
        state: present

    - name: Enable PubkeyAuthentication
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^PubkeyAuthentication.*"
        line: "PubkeyAuthentication yes"
        state: present

    - name: Create vault agent dir
      file:
        path: /etc/vault-agent
        state: directory
        owner: root
        group: root
        mode: '0644'
    
    - name: Create vault agent config
      copy:
        dest: /etc/vault-agent/config.hcl
        content: |
          vault {
            address = "http://vault.home.lan:8205"
          }

          auto_auth {
            method "approle" {
              mount_path = "auth/approle"

              config = {
                role_id_file_path   = "/etc/vault-agent/role_id"
                secret_id_file_path = "/etc/vault-agent/secret_id"
                remove_secret_id_file_after_reading = false
              }
            }

            sink "file" {
              config = {
                path = "/tmp/vault-token"
              }
            }
          }

          template {
            destination = "/home/jd/.ssh/id_ed25519-cert.pub"
            perms = "0644"
            user = "jd"
            group = "jd"
            contents = <<EOH
            {{ '{{' }}- with secret "ssh/sign/admin" (printf "public_key=%s" (trimSpace (file "/home/jd/.ssh/id_ed25519.pub"))) "valid_principals=jd" {{  '}}'}}{{ '{{' }} .Data.signed_key {{ '}}' }}{{ '{{' }} end -{{ '}}' }}
            EOH
          }
        owner: root
        group: root
        mode: '0644'

    - name: Create file with token for vault agent
      copy:
        dest: /etc/vault-agent/token
        content: "{{ vault_sshcert_token }}"
        owner: root
        group: root
        mode: '0600'

    - name: Create file with role_id for vault agent
      copy:
        dest: /etc/vault-agent/role_id
        content: "{{ vault_ssh_client_role_id }}"
        owner: root
        group: root
        mode: '0600'
        
    - name: Create file with secret_id for vault agent
      copy:
        dest: /etc/vault-agent/secret_id
        content: "{{ vault_ssh_client_secret_id }}"
        owner: root
        group: root
        mode: '0600'

    - name: Create service for vault agent
      copy:
        dest: /etc/systemd/system/vault-agent.service
        content: |
          [Unit]
          Description=Vault Agent
          After=network-online.target

          [Service]
          ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
          Restart=always
          User=root
          Group=root

          [Install]
          WantedBy=multi-user.target
        owner: root
        group: root
        mode: '0644'

    - name: Enable and start vault agent service
      systemd:
        name: vault-agent
        enabled: yes
        state: started
        
    - name: Restart sshd
      ansible.builtin.service:
        name: sshd
        state: restarted

    - name: Sync time
      ansible.builtin.command:
        cmd: chronyc makestep
      changed_when: false