# ------------------------------------------------------------------------------
# FILE: roles/common/tasks/main.yml
# DESCRIPTION: Baseline configuration applied to all managed hosts.
#              Handles hostname, timezone, core packages, NTP, and
#              ansible user setup.
# ------------------------------------------------------------------------------

- name: Set hostname
  hostname:
    name: "{{ inventory_hostname | replace('_', '-') }}"

- name: Set timezone
  community.general.timezone:
    name: "{{ common_timezone }}"

- name: Update apt cache
  apt:
    update_cache: yes
    cache_valid_time: 3600

- name: Install base utility packages
  apt:
    name: "{{ common_packages }}"
    state: present

- name: Install chrony
  apt:
    name: chrony
    state: present

- name: Configure chrony to use sundial
  template:
    src: chrony.conf.j2
    dest: /etc/chrony/chrony.conf
    mode: '0644'
  notify: restart chrony

- name: Ensure chrony is enabled and running
  systemd:
    name: chrony
    state: started
    enabled: yes

- name: Ensure ansible user has sudo without password
  lineinfile:
    path: /etc/sudoers.d/{{ ansible_user }}
    line: "{{ ansible_user }} ALL=(ALL) NOPASSWD:ALL"
    create: yes
    mode: '0440'
    validate: 'visudo -cf %s'

# --- Step-CA SSH certificate enrollment ---
- name: Enroll host in step-ca SSH CA
  include_tasks: step_ca_client.yml

- name: Create authorized principals directory
  ansible.builtin.file:
    path: /etc/ssh/auth_principals
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: Create authorized principals files
  ansible.builtin.copy:
    content: "{{ item.principals | join('\n') }}\n"
    dest: "/etc/ssh/auth_principals/{{ item.local_user }}"
    owner: root
    group: root
    mode: '0644'
  loop: "{{ step_ca_principal_mappings }}"
  notify: restart sshd

- name: Configure sshd AuthorizedPrincipalsFile
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    line: "AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u"
    regexp: "^#?AuthorizedPrincipalsFile"
    state: present
  notify: restart sshd