---
- name: Install A13Labs systools
  hosts: ubuntu
  gather_facts: true

# Specific tasks for this playbook
  tasks:
    - name: Set required facts
      ansible.builtin.set_fact:
        systools_version: "{{ systools_version | default('0.2.0') }}"
        ssh_locker_timeout: "{{ ssh_locker_timeout | default('5m') }}"
      tags: always

    - name: Download systools zip file
      ansible.builtin.get_url:
        url: https://github.com/a13labs/systools/releases/download/v{{ systools_version }}/systools-v{{ systools_version }}-linux-amd64.zip
        dest: /tmp/systools-v{{ systools_version }}-linux-amd64.zip
        mode: '0644'

    - name: Unpack systools zip file
      become: true
      failed_when: false
      ansible.builtin.unarchive:
        src: /tmp/systools-v{{ systools_version }}-linux-amd64.zip
        dest: /usr/local/bin
        remote_src: true
        mode: '0755'
        extra_opts:
          - -j

    - name: Remove systools zip file
      ansible.builtin.file:
        path: /tmp/systools-v{{ systools_version }}-linux-amd64.zip
        state: absent

    - name: Set root-only executable permissions for specific tools
      become: true
      ansible.builtin.file:
        path: /usr/local/bin/{{ item }}
        mode: '0700'
      loop:
        - open_volume
        - read_system_id
        - k8s_encryption_provider

    - name: Create shared socket directory
      become: true
      ansible.builtin.file:
        path: /var/run/ssh_locker
        state: directory
        mode: '0777'

    - name: Install ssh_locker service
      become: true
      ansible.builtin.template:
        src: ssh_locker.service.j2
        dest: /etc/systemd/system/ssh_locker.service
        mode: '0644'
      notify:
        - Reload systemd daemon
        - Enable ssh_locker service
        - Start ssh_locker service

  handlers:
    - name: Reload systemd daemon
      become: true
      ansible.builtin.systemd:
        daemon_reload: true

    - name: Enable ssh_locker service
      become: true
      ansible.builtin.systemd:
        name: ssh_locker
        enabled: true

    - name: Start ssh_locker service
      become: true
      ansible.builtin.systemd:
        name: ssh_locker
        state: started