- name: Accounts (team for the teams, icpc for the administrator)
  hosts: all
  become: yes
  vars:
    # admin_pass comes from build.sh. team_pass is optional: without it, the
    # team account keeps the password of the ICPC image (contest).
    team_pass: ""
    autologin: true

  tasks:
    # The password of icpc changes and team leaves the sudo group in finish.yml,
    # at the very end, because Ansible may be using those accounts for sudo
    - name: Check that the administrator password is given
      assert:
        that: admin_pass is defined and admin_pass | length > 0
        fail_msg: "Give the new password of the icpc account with -e admin_pass=..."

    - name: Make sure the root account stays locked (no root password)
      command: passwd -l root
      register: lock_root
      changed_when: "'unchanged' not in lock_root.stdout"

    - name: Log the teams in automatically (team account)
      copy:
        dest: /etc/lightdm/lightdm.conf.d/90-acpc-autologin.conf
        mode: '0644'
        content: |
          [Seat:*]
          autologin-user=team
          autologin-user-timeout=0
      when: autologin | bool

    - name: No automatic login
      file:
        path: /etc/lightdm/lightdm.conf.d/90-acpc-autologin.conf
        state: absent
      when: not (autologin | bool)

    # The ICPC image lets every account run vscode-extension-install as root
    # without a password, at login. That script mounts and changes paths in
    # the home directory, which the account controls. Here it runs at boot for
    # the team account only, after a check of those paths.
    - name: Remove the sudo rule of vscode-extension-install
      file:
        path: /etc/sudoers.d/vscode-extension-install
        state: absent

    - name: Do not run vscode-extension-install at login
      lineinfile:
        path: /etc/xdg/autostart/vscode-extension-install.desktop
        line: Hidden=true

    - name: Install the boot-time VS Code setup of the team account
      copy:
        src: "files/security/{{ item.src }}"
        dest: "{{ item.dest }}"
        mode: "{{ item.mode }}"
      loop:
        - { src: team-vscode-extensions, dest: /usr/local/sbin/team-vscode-extensions, mode: '0700' }
        - { src: team-vscode-extensions.service, dest: /etc/systemd/system/team-vscode-extensions.service, mode: '0644' }

    - name: Enable it
      systemd:
        name: team-vscode-extensions.service
        enabled: yes
        daemon_reload: yes

    # The boot menu is hidden, but Esc shows it, and editing an entry gives a
    # root shell (init=/bin/bash). Editing and the other entries need the user
    # admin with the administrator password. The normal boot needs nothing.
    - name: Hash the boot menu password
      shell: printf '%s\n%s\n' "$PASS" "$PASS" | grub-mkpasswd-pbkdf2 | sed -n 's/.* is //p'
      environment:
        PASS: "{{ admin_pass }}"
      register: grub_hash
      changed_when: false
      no_log: true

    - name: Protect the boot menu with a password
      copy:
        dest: /etc/grub.d/01_acpc_password
        # Root only: the file holds the password hash (also the icpc password)
        mode: '0700'
        content: |
          #!/bin/sh
          cat <<'EOF'
          set superusers="admin"
          password_pbkdf2 admin {{ grub_hash.stdout }}
          EOF
      no_log: true

    - name: Let the Ubuntu entries boot without the password
      replace:
        path: /etc/grub.d/10_linux
        regexp: '^CLASS="--class gnu-linux --class gnu --class os"$'
        replace: 'CLASS="--class gnu-linux --class gnu --class os --unrestricted"'

    - name: No recovery entries in the boot menu
      copy:
        dest: /etc/default/grub.d/90-acpc.cfg
        mode: '0644'
        content: |
          GRUB_DISABLE_RECOVERY="true"

    - name: Rebuild the boot menu
      command: update-grub
      changed_when: true

    - name: Check the boot menu
      shell: grep -c -- '--unrestricted' /boot/grub/grub.cfg && grep -q 'set superusers="admin"' /boot/grub/grub.cfg
      changed_when: false