---

- hosts: all
  name: setup desktop
  vars_files:
    - secrets
  tasks:
    - name: remove fedora fluff
      become: true
      ansible.builtin.dnf:
        allowerasing: true
        autoremove: true
        name:
          - anaconda-core
          - anaconda-live
          - anaconda-install-env-deps
          - cockpit-system
          - python3-botocore
          - firefox
          - nodejs
        state: absent
    - name: install core components
      become: true
      ansible.builtin.dnf:
        state: present
        install_weak_deps: false
        name:
          - git
          - git-crypt
          - git-lfs
          - gnupg2
          - tmux
          - curl
          - acl
          - stow
          - make
          - just
          - zsh
          - neovim
          - nnn
          - openssh-clients
          - openssh-server
          - mosh
          - unzip
          - flatpak
    - name: install pup
      become: true
      unarchive:
        remote_src: yes
        creates: /usr/local/bin/pup
        dest: /usr/local/bin/
        src: https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip
    - name: install google-chrome dnf repository
      become: true
      copy:
        dest: /etc/yum.repos.d/google-chrome.repo
        content: |
          [google-chrome]
          name=google-chrome
          baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
          enabled=1
          gpgcheck=1
          gpgkey=https://dl.google.com/linux/linux_signing_key.pub
    - name: install tailscale dnf repository
      become: true
      copy:
        dest: /etc/yum.repos.d/tailscale.repo
        content: |
          [tailscale]
          name=Tailscale
          baseurl=https://pkgs.tailscale.com/stable/fedora/$basearch
          enabled=1
          type=rpm
          repo_gpgcheck=1
          gpgcheck=1
          gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg
    - name: install dnf packages
      become: true
      ansible.builtin.dnf:
        state: present
        install_weak_deps: false
        name:
          - aria2
          - bat
          - bc
          - btop
          - btrfs-progs
          - coreutils
          - moreutils
          - fcitx5-gtk4
          - file
          - gh
          - google-chrome-stable
          - gparted
          - jo
          - jq
          - jrnl
          - kitty
          - kitty-terminfo
          - lshw
          - mpv
          - ncdu
          - pandoc
          - podman
          - runc
          - pass
          - wtype
          - tailscale
          - rclone
          - rsync
          - seahorse
          - timew
          - toolbox
          - tree
          - fzf
          - socat
          - tree-sitter-cli
          - waybar
          - wkhtmltopdf
          - yq
          - ImageMagick
    - name: install flatpak applications
      become: true
      flatpak:
        state: present
        name:
          - https://valent.andyholmes.ca/valent.flatpakref
          - com.nextcloud.desktopclient.nextcloud
          - org.libreoffice.LibreOffice
          - org.mozilla.Thunderbird

          - com.logseq.Logseq
          - com.github.xournalpp.xournalpp

          - com.obsproject.Studio

          - com.yubico.yubioath
          - com.github.tchx84.Flatseal

          - org.gnome.Loupe
          - com.github.johnfactotum.Foliate
          - org.gnome.Papers
          - org.gnome.FileRoller
          - org.gnome.SimpleScan

          - com.github.neithern.g4music
          - info.febvre.Komikku

          - org.gimp.GIMP
          - net.scribus.Scribus
          - org.inkscape.Inkscape
          - org.darktable.Darktable
          - org.audacityteam.Audacity
    - name: create group myself
      become: true
      group:
        name: myself
        gid: 690
        system: true
    - name: create group rootlessmen
      become: true
      group:
        name: rootlessmen
        system: true
    - name: create users
      become: true
      with_items:
        - name: kevins
          uid: 6901
          groups: ["myself", "rootlessmen"]
        - name: kevinsamuel
          uid: 6902
          groups: myself
        - name: kevinnlsamuel
          uid: 6903
          groups: ["myself", "rootlessmen"]
      user:
        state: present
        name: "{{ item.name }}"
        uid: "{{ item.uid }}"
        groups: "{{ item.groups }}"
        skeleton: /dev/null
        append: true
        password: $1$aBLdYKQI$iB3ZfYF.QPCwVhgnkROUX.
        update_password: on_create
        shell: /bin/zsh

    - name: use crun as podman engine
      become: true
      vars:
        file: /etc/containers/containers.conf
      block:
        - lineinfile:
            owner: root
            group: root
            mode: '0644'
            create: true
            path: "{{file}}"
            line: "[engine]"
            insertbefore: BOF
        - lineinfile:
            path: "{{file}}"
            line: 'runtime = "/usr/bin/runc"'
            search_string: 'runtime = '
    - name: create storage for rootlessmen
      become: true
      file:
        path: /var/lib/rootlessmen
        owner: root
        group: rootlessmen
        mode: "0770"
        state: directory
    - name: setup podman to use rootlessmen for storage
      become: true
      vars:
        file: /etc/containers/storage.conf
      block:
        - name: create container storage config
          lineinfile:
            owner: root
            group: root
            mode: '0644'
            create: true
            path: "{{file}}"
            line: "[storage]"
            insertbefore: BOF
        - name: setup storage config to use rootlessmen
          with_items:
            - line: 'driver_priority = ["btrfs", "overlay", "vfs"]'
              search_string: 'driver_priority = '
            - line: 'rootless_storage_path = "/var/lib/rootlessmen/$USER/storage"'
              search_string: 'rootless_storage_path = '
          lineinfile:
            path: "{{file}}"
            line: "{{item.line}}"
            search_string: "{{item.search_string}}"
    - name: set selinux fcontext for rootlessmen
      become: true
      with_items:
        - pathspec: /var/lib/rootlessmen/[^/]+/storage/artifacts(/.*)?
          type: container_ro_file_t
        - pathspec: /var/lib/rootlessmen/[^/]+/storage/volumes/[^/]*/.*
          type: container_file_t
      sefcontext:
        target: "{{item.pathspec}}"
        setype: "{{item.type}}"
        seuser: unconfined_u

    - name: enable tpm-tss in dracut
      become: true
      lineinfile:
        path: /etc/dracut.conf.d/55-tpm.conf
        line: "add_dracutmodules+=' tpm2-tss '"
        owner: root
        group: root
        mode: "1644"
        create: true
        state: present
    - name: tell PAM to unlock gnome-keyring in tty
      become: true
      with_items:
        - type: auth
          args: ""
        - type: session
          args: auto_start
      pamd:
        name: login
        state: before
        type: "{{item.type}}"
        control: include
        module_path: postlogin
        new_type: "-{{item.type}}"
        new_control: optional
        new_module_path: pam_gnome_keyring.so
        module_arguments: "{{item.args}}"

    - name: create wifi networks
      become: true
      loop:
        - ssid: KEVINSAM_5
          zone: home
        - ssid: KEVINSAM
          zone: home
        - ssid: askKevin
          zone: work
      community.general.nmcli:
        state: present
        type: wifi
        zone: "{{ item.zone }}"
        conn_name: "{{ item.ssid }}"
        ssid: "{{ item.ssid }}"
        autoconnect: true
        wifi:
          hidden: true
        wifi_sec:
          key-mgmt: wpa-psk
          psk: "not really the key"

    - name: create tailscale firewall zone
      become: true
      shell: |
        firewall-cmd --permanent --new-zone=tailscale
        firewall-cmd --permanent --zone=tailscale --add-interface=tailscale0
        firewall-cmd --permanent --zone=tailscale --add-forward
        firewall-cmd --permanent --zone=tailscale --set-target=ACCEPT
        firewall-cmd --reload

    - name: other firewall rules
      become: true
      shell: |
        firewall-cmd --permanent --zone public --remove-service ssh
        firewall-cmd --permanent --zone public --add-service kdeconnect
        firewall-cmd --permanent --zone home --add-service=kdeconnect --add-service=mosh --add-service=ssh
        firewall-cmd --reload

    - name: create /home/myself
      become: true
      file:
        state: directory
        path: /home/myself
        group: myself
        owner: kevins
        mode: '2770'
    - name: check if HOME.git is cloned
      become: true
      become_user: kevins
      register: home_repo
      stat:
        path: /home/myself/HOME.git/HEAD
    - name: "clone HOME.git"
      become: true
      become_user: kevins
      when: not home_repo.stat.exists
      shell: |
        mkdir -p /home/myself/HOME.git
        cd /home/myself/HOME.git
        git init --bare .
        git remote add \
          origin \
          -t stable \
          -m stable \
          https://{{PAT}}@github.com/kevinnlsamuel/HOME.git
        git fetch --set-upstream origin stable

    - name: clone HOME to my selves
      vars:
        src: /home/myself/HOME.git
        dest: "/home/{{item}}/.local/state/HOME"
      with_items:
        - kevins
        - kevinsamuel
        - kevinnlsamuel
      become_user: "{{item}}"
      become: true
      failed_when:
        - result.rc != 140
        - result.rc != 0
      changed_when: "result.rc != 140"
      register: result
      shell: |
        mkdir -p "{{dest}}"
        cd "{{dest}}"
        if [ -f ".git/HEAD" ]; then exit 140 2>/dev/null; fi
        git init -b main
        git config --add safe.directory "{{src}}"
        git remote add myself "{{src}}"
        git pull myself main

# manually install:
#   - sieve