- name: End of the build (SSH settings of the ICPC image, cleanup, power off)
  hosts: all
  become: yes
  tasks:
    # build.sh replaced these settings to log in during the build
    - name: Restore the SSH settings of the ICPC image
      copy:
        dest: /etc/ssh/sshd_config.d/icpc.conf
        mode: '0644'
        content: |
          PasswordAuthentication no
          DenyGroups judges teams

    - name: Remove the SSH settings of the build
      file:
        path: /etc/ssh/sshd_config.d/00-build.conf
        state: absent

    - name: Empty the package cache
      command: apt-get clean
      changed_when: false

    # Last task, in one go because Ansible may be using sudo through the team
    # account (first build) or the icpc account (next builds):
    # - icpc, the administrator account, gets the new password
    # - team, the account of the teams, gets its new password if one is given
    # - team leaves the sudo group (the ICPC image gives it sudo with the
    #   public password "contest")
    - name: Set the passwords, remove team from sudo and power off
      shell: |
        set -e
        echo "icpc:$ADMIN_PASS" | chpasswd
        if [ -n "$TEAM_PASS" ]; then echo "team:$TEAM_PASS" | chpasswd; fi
        if id -nG team | grep -qw sudo; then gpasswd -d team sudo; fi
        systemd-run --on-active=5 systemctl poweroff
      environment:
        ADMIN_PASS: "{{ admin_pass }}"
        TEAM_PASS: "{{ team_pass | default('') }}"
      no_log: true