- name: Vaultwarden
  hosts: beepi
  become: true
  vars:
    recovery_2fa: !vault |
            $ANSIBLE_VAULT;1.1;AES256
            33656334663834356232623236316238396630656530363332353566363433356133313932613230
            3063613030363566376635363830336466333237633063310a666236333335363566343237646135
            65656466363833373231653565306563333036373664316535366339393531363434386336303563
            6636396665316634320a643966313338633564363830663263666461303635623164376265633631
            39633162323130663533343734303538636433323632316131373531376438633432323433303234
            3162626630373264356338356638323364656563666635393636

    user: vaultwarden
    user_home: /home/vaultwarden
    vaultwarden_domain: vault.secretbee.buzz

    # Bootstrap = -e vaultwarden_signups_allowed=true
    vaultwarden_signups_allowed: false

  tasks:
    - name: Install dependencies
      ansible.builtin.apt:
        name: "{{ item }}"
        state: present
      loop:
        - podman
        - systemd-container
        - passt

    - name: Create user
      ansible.builtin.user:
        name: "{{ user }}"
        home: "{{ user_home }}"
        shell: /usr/sbin/nologin
        create_home: true
      register: user_info

    - name: Enable linger
      ansible.builtin.command:
        cmd: "loginctl enable-linger {{ user }}"
        creates: "/var/lib/systemd/linger/{{ user }}"

    - name: Create quadlet directory
      ansible.builtin.file:
        path: "{{ user_home }}/.config/containers/systemd"
        state: directory
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: '0755'

    - name: Create data directory
      ansible.builtin.file:
        path: "{{ user_home }}/data"
        state: directory
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: '0700'

    - name: Deploy server quadlet
      ansible.builtin.template:
        src: vaultwarden.container.j2
        dest: "{{ user_home }}/.config/containers/systemd/vaultwarden.container"
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: '0600'

    - name: Reload user systemd
      become: true
      become_user: "{{ user }}"
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ user_info.uid }}"
        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ user_info.uid }}/bus"
      ansible.builtin.systemd:
        daemon_reload: true
        scope: user

    - name: Start user manager
      ansible.builtin.systemd:
        name: "user@{{ user_info.uid }}.service"
        state: started

    - name: Start vaultwarden
      become: true
      become_user: "{{ user }}"
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ user_info.uid }}"
        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ user_info.uid }}/bus"
      ansible.builtin.systemd:
        name: vaultwarden.service
        state: restarted
        scope: user

    - name: Debug
      ansible.builtin.debug:
        msg:
          - "Service status: sudo systemctl --user --machine {{ user_info.name }}@.host status vaultwarden"
          - "Read logs: sudo journalctl _UID={{ user_info.uid }} -n 200 --no-pager"
          - "Shell: sudo machinectl shell {{ user_info.name }}@.host /bin/bash"
      tags:
        - always