- import_role:
    name: jail
    tasks_from: jail_setup

# --- Shared git-shell-commands ---

- name: Create /usr/local/libexec/git-shell-commands directory
  file:
    path: /var/db/repos/git-shell-commands
    state: directory
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy git-shell-commands
  copy:
    src: "{{ jail_role_dir }}/files/git-shell-commands/{{ item }}"
    dest: "/var/db/repos/git-shell-commands/{{ item }}"
    owner: root
    group: wheel
    mode: "0755"
  loop:
    - help
    - new
    - ls
    - delete
    - rename
    - describe
    - mirror-to

# --- Remove legacy git user ---

- name: Remove legacy git user
  user:
    name: git
    state: absent
    remove: false
  ignore_errors: true

- name: Remove legacy git group
  group:
    name: git
    state: absent
  ignore_errors: true

# --- Forge users ---

- name: Create forge user groups
  group:
    name: "{{ item.name }}"
    gid: "{{ item.uid }}"
  loop: "{{ forge_users }}"
  loop_control:
    label: "{{ item.name }}"

- name: Create forge users
  user:
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    group: "{{ item.name }}"
    home: /var/db/repos
    shell: /usr/local/bin/git-shell
    create_home: false
  loop: "{{ forge_users }}"
  loop_control:
    label: "{{ item.name }}"

- name: Create per-user config directories
  file:
    path: "/var/db/forge-config/{{ item.name }}"
    state: directory
    owner: "{{ item.name }}"
    group: "{{ item.name }}"
    mode: "0700"
  loop: "{{ forge_users }}"
  loop_control:
    label: "{{ item.name }}"

- name: Create .ssh directories for forge users
  file:
    path: "/var/db/forge-config/{{ item.name }}/.ssh"
    state: directory
    owner: "{{ item.name }}"
    group: "{{ item.name }}"
    mode: "0700"
  loop: "{{ forge_users }}"
  loop_control:
    label: "{{ item.name }}"

- name: Deploy authorized_keys for forge users
  copy:
    content: "{{ item.authorized_keys }}\n"
    dest: "/var/db/forge-config/{{ item.name }}/.ssh/authorized_keys"
    owner: "{{ item.name }}"
    group: "{{ item.name }}"
    mode: "0600"
  loop: "{{ forge_users }}"
  loop_control:
    label: "{{ item.name }}"

- name: Deploy gitconfig for primary forge user (jan)
  copy:
    content: |
      [init]
          defaultBranch = main
    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.gitconfig"
    owner: "{{ forge_users[0].name }}"
    group: "{{ forge_users[0].name }}"
    mode: "0644"

- name: Deploy forge deploy private key
  copy:
    content: "{{ forge_deploy_key.private }}"
    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy"
    owner: "{{ forge_users[0].name }}"
    group: "{{ forge_users[0].name }}"
    mode: "0600"

- name: Deploy forge deploy public key
  copy:
    content: "{{ forge_deploy_key.public }}"
    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy.pub"
    owner: "{{ forge_users[0].name }}"
    group: "{{ forge_users[0].name }}"
    mode: "0644"

- name: Deploy SSH config for primary forge user
  copy:
    content: |
      Host *
          IdentityFile /var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy
          IdentitiesOnly yes
          StrictHostKeyChecking=accept-new
    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/config"
    owner: "{{ forge_users[0].name }}"
    group: "{{ forge_users[0].name }}"
    mode: "0600"

# --- Git mirrors ---

- name: Create git-mirrors log file
  file:
    path: /var/log/git-mirrors.log
    state: touch
    owner: "{{ forge_users[0].name }}"
    group: "{{ forge_users[0].name }}"
    mode: "0644"

- name: Deploy git-mirrors script
  copy:
    src: "{{ jail_role_dir }}/files/git-mirrors.sh"
    dest: /usr/local/bin/git-mirrors
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy crontab for primary forge user
  copy:
    content: |
      SHELL=/bin/sh
      PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
      0 * * * * /usr/local/bin/git-mirrors
    dest: "/var/cron/tabs/{{ forge_users[0].name }}"
    owner: root
    group: wheel
    mode: "0600"

# --- cgit/www config ---

- name: Create /usr/local/etc/git directory
  file:
    path: /usr/local/etc/git
    state: directory
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy gitconfig for www user (safe.directory for cgit/fcgiwrap)
  copy:
    content: |
      [safe]
          directory = *
    dest: /usr/local/etc/git/gitconfig-www
    owner: root
    group: wheel
    mode: "0644"

- name: Create /usr/local/etc/cgit directory
  file:
    path: /usr/local/etc/cgit
    state: directory
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy cgit head-include
  copy:
    src: "{{ jail_role_dir }}/files/head-include.html"
    dest: /usr/local/etc/cgit/head-include.html
    owner: root
    group: wheel
    mode: "0644"

- name: Deploy custom cgit.css
  copy:
    src: "{{ jail_role_dir }}/files/cgit.css"
    dest: /usr/local/www/cgit/cgit.css
    owner: root
    group: wheel
    mode: "0644"

- name: Deploy syntax-highlighting filter
  copy:
    src: "{{ jail_role_dir }}/files/syntax-highlighting.sh"
    dest: /usr/local/lib/cgit/filters/syntax-highlighting.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy custom md2html filter
  copy:
    src: "{{ jail_role_dir }}/files/md2html"
    dest: /usr/local/lib/cgit/filters/html-converters/md2html
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy custom about-formatting filter
  copy:
    src: "{{ jail_role_dir }}/files/about-formatting.sh"
    dest: /usr/local/lib/cgit/filters/about-formatting.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy nginx config
  template:
    src: "{{ jail_role_dir }}/templates/usr_local_etc_nginx_nginx.conf.j2"
    dest: /usr/local/etc/nginx/nginx.conf
    owner: root
    group: wheel
    mode: "0644"
  notify: Reload nginx

- name: Deploy cgitrc
  template:
    src: "{{ jail_role_dir }}/templates/usr_local_etc_cgitrc.j2"
    dest: /usr/local/etc/cgitrc
    owner: root
    group: wheel
    mode: "0644"

- name: Deploy sshd_config
  template:
    src: "{{ jail_role_dir }}/templates/etc_ssh_sshd_config.j2"
    dest: /etc/ssh/sshd_config
    owner: root
    group: wheel
    mode: "0644"
  notify: Restart sshd
- import_role:
    name: jail
    tasks_from: jail_launch