- name: Hetzner
  hosts: beepi
  become: true
  vars:
    user: hetzner
    user_home: /home/hetzner

    hetzner_raid_mount: /home/beeshare/raid
    hetzner_port: 23

    hetzner_paths:
      - src: /home/beeshare/raid/serverBackup
        dest: ./beepi
      - src: /home/beeshare/raid/foundry/backup
        dest: ./foundry

    # Fill in after creating the storage box sub-account, then re-run
    hetzner_host: "u651287.your-storagebox.de"
    hetzner_user: "u651287"

  tasks:
    - name: Install rsync
      ansible.builtin.apt:
        name: rsync
        state: present

    - name: Create user
      ansible.builtin.user:
        name: "{{ user }}"
        home: "{{ user_home }}"
        shell: /usr/sbin/nologin
        create_home: true

    - name: Create ssh directory
      ansible.builtin.file:
        path: "{{ user_home }}/.ssh"
        state: directory
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: '0700'

    - name: Generate ssh key
      ansible.builtin.command:
        cmd: "ssh-keygen -t ed25519 -N '' -C beepi-hetzner -f {{ user_home }}/.ssh/id_ed25519"
        creates: "{{ user_home }}/.ssh/id_ed25519"

    - name: Set key ownership
      ansible.builtin.file:
        path: "{{ user_home }}/.ssh/{{ item.name }}"
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: "{{ item.mode }}"
      loop:
        - name: id_ed25519
          mode: '0600'
        - name: id_ed25519.pub
          mode: '0644'

    - name: Scan storage box host key
      ansible.builtin.command:
        cmd: "ssh-keyscan -p {{ hetzner_port }} {{ hetzner_host }}"
      register: hetzner_hostkey
      changed_when: false
      when: hetzner_host | length > 0

    - name: Pin known hosts
      ansible.builtin.copy:
        dest: "{{ user_home }}/.ssh/known_hosts"
        content: "{{ hetzner_hostkey.stdout }}\n"
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: '0600'
      when: hetzner_host | length > 0

    - name: Copy sync script
      ansible.builtin.template:
        src: hetznerSync.sh.j2
        dest: /opt/backup/hetznerSync.sh
        mode: '0700'
      when: hetzner_host | length > 0

    - name: Schedule daily sync
      ansible.builtin.cron:
        name: beepi hetzner sync
        user: root
        minute: '0'
        hour: '7'
        job: /opt/backup/hetznerSync.sh >> /var/log/beepi-backup.log 2>&1
      when: hetzner_host | length > 0

    - name: Debug
      ansible.builtin.debug:
        msg:
          - "Test manually: sudo /opt/backup/hetznerSync.sh"
          - "Read logs: sudo tail -50 /var/log/beepi-backup.log"
      tags:
        - always