---
- name: ajoute le groupe "camino"
  ansible.builtin.group:
    name: camino
    state: present
    # Le GID doit être le même que dans le Dockerfile.api
    gid: "{{ camino_user_gid }}"
  become: True
- name: ajoute le groupe "docker"
  ansible.builtin.group:
    name: docker
    state: present
  become: True
- name: ajoute l'utilisateur 'camino'
  ansible.builtin.user:
    name: camino
    comment: Camino
    shell: "/bin/bash"
    # L'UID doit être le même que dans le Dockerfile.api
    uid: "{{ camino_user_uid }}"
    groups: camino, users, docker
  become: True
- name: Ajout utilisateurs
  include_tasks: "devs.yml"
  loop: "{{ users }}"
  loop_control:
    loop_var: camino_dev
- file:
    path: /srv/www/camino/files
    group: users
    state: directory
    recurse: True
    owner: camino
    mode: u=rwx,g=rwx,o=r
  become: True
- name: supprime l'utilisateur debian
  ansible.builtin.user:
    name: debian
    state: absent
    remove: True
    force: True
  become: True
- name: Configure le serveur ssh
  block:
    - name: Copie la configuration extra de ssh
      ansible.builtin.copy:
        src: ssh_hardening.conf
        dest: /etc/ssh/sshd_config_extra_ssh_hardening.conf
        owner: root
        group: root
        mode: u=rw,g=r,o=r
      become: True
      notify: Restart SSH
    - name: Charge la configuration ssh_hardening
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        line: 'Include /etc/ssh/sshd_config_extra_ssh_hardening.conf'
      become: True
      notify: Restart SSH
    - name: Empêche ssh de charger des configurations dans des sous-fichiers
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        search_string: 'Include /etc/ssh/sshd_config.d/*.conf'
        line: '#Include /etc/ssh/sshd_config.d/*.conf'
      become: True
      notify: Restart SSH
    - name: Empêche le forwarding de x11
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^X11Forwarding'
        line: 'X11Forwarding no'
      become: True
      notify: Restart SSH
    - name: Empêche le login par mot de passe
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PasswordAuthentication'
        line: 'PasswordAuthentication no'
      become: True
      notify: Restart SSH
    - name: Empêche le login de l'utilisateur root
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin'
        line: 'PermitRootLogin no'
      become: True
      notify: Restart SSH
    - name: Supprime les configurations extra de ssh
      file:
        state: absent
        path: /etc/ssh/sshd_config.d
      become: True
      notify: Restart SSH