playbook.yml

---
- name: Configure Server
  hosts: all
  become: true
  roles:
    - config
    - geerlingguy.docker

  tasks:
    - name: Set up pplanel user with sudo privileges
      ansible.builtin.user:
        name: pplanel
        shell: /bin/bash
        groups: 
          - sudo
          - docker
        append: yes
        create_home: yes
      register: created_user

    - name: Install Rust
      ansible.builtin.include_role:
        name: hurricanehrndz.rustup
      vars:
        rustup_user: pplanel
        rustup_cargo_crates: []

    - name: Create the .ssh directory
      become: true
      become_user: "{{ created_user.name }}"
      ansible.builtin.file:
        path: "{{ created_user.home }}/.ssh"
        state: directory
        mode: '0755'

    - name: Generate an OpenSSH keypair with the default values (4096 bits, rsa)
      become: true
      become_user: "{{ created_user.name }}"
      community.crypto.openssh_keypair:
        path: "{{ created_user.home }}/.ssh/deploy_key"
        comment: "api_host@aws"
      register: created_deploy_key

    - name: Read Ubuntu authorized_keys
      ansible.builtin.slurp:
        src: "/home/ubuntu/.ssh/authorized_keys"
      register: "ubuntu_authorized_keys"

    - name: Add deploy_key.pub to the authorized_keys file
      become: true
      become_user: "{{ created_user.name }}"
      ansible.posix.authorized_key:
        key: "{{ created_deploy_key.public_key }}"
        state: present
        user: "{{ created_user.name }}"

    - name: Add genesis pkey to the authorized_keys file
      become: true
      become_user: "{{ created_user.name }}"
      ansible.builtin.lineinfile:
        path: "{{ created_user.home }}/.ssh/authorized_keys"
        state: present
        insertafter: "EOF"
        line: "{{ ubuntu_authorized_keys['content'] }}"


    - name: Update sshd_config to disallow root login and password authentication
      lineinfile:
        path: /etc/ssh/sshd_config
        line: |
          PermitRootLogin no
          PasswordAuthentication no
        backup: yes
      notify: Restart SSH

  handlers:
    - name: Restart SSH
      service:
        name: ssh
        state: restarted