---
# Create and configure the vnc user
- name: Create the VNC user
  ansible.builtin.user:
    # Ansible will start treating append: true and groups omitted as
    # an error in version 2.14, so we need append: true only if groups
    # is nonempty.
    append: "{{ (vnc_server_user_groups | default([]) | length > 0) | bool }}"
    groups: "{{ vnc_server_user_groups | default(omit) }}"
    name: "{{ vnc_server_username }}"
    shell: /bin/bash
    uid: "{{ vnc_server_user_uid | default(omit) }}"

- name: Set VNC password for VNC user
  block:
    - name: Create .vnc directory for VNC user
      ansible.builtin.file:
        path: /home/{{ vnc_server_username }}/.vnc
        state: directory
        mode: 0755
        owner: "{{ vnc_server_username }}"
        group: "{{ vnc_server_username }}"

    - name: Set VNC password for VNC user
      ansible.builtin.shell: |
        set -o pipefail
        echo {{ vnc_server_password }} | vncpasswd -f > /home/{{ vnc_server_username }}/.vnc/passwd
      args:
        executable: /bin/bash
        creates: /home/{{ vnc_server_username }}/.vnc/passwd

    - name: Set correct permissions for VNC passwd file
      ansible.builtin.file:
        path: /home/{{ vnc_server_username }}/.vnc/passwd
        owner: "{{ vnc_server_username }}"
        group: "{{ vnc_server_username }}"
        mode: 0600

# Install an SSH keypair for the VNC user.  This will enable Guacamole
# to perform file transfers to/from this instance.
- name: Install SSH keys for VNC user
  block:
    - name: Validate value of ssh_key_type
      ansible.builtin.assert:
        fail_msg: >
          "{{ vnc_server_ssh_key_type }} is not a valid value for the SSH key
          type.  Valid values are: DSA, ECDSA, ECDSA_SK, ED25519,
          ED25519_SK, or RSA."
        that:
          - (vnc_server_ssh_key_type | lower) in ["dsa", "ecdsa", "ecdsa_sk", "ed25519", "ed25519_sk", "rsa"]

    - name: Create .ssh directory for VNC user
      ansible.builtin.file:
        path: "/home/{{ vnc_server_username }}/.ssh"
        state: directory
        owner: "{{ vnc_server_username }}"
        group: "{{ vnc_server_username }}"
        mode: 0755

    - name: Install SSH public key for VNC user
      ansible.builtin.copy:
        content: "{{ vnc_server_public_ssh_key }}"
        dest: "/home/{{ vnc_server_username }}/.ssh/id_{{ vnc_server_ssh_key_type | lower }}.pub"
        mode: 0644
        owner: "{{ vnc_server_username }}"
        group: "{{ vnc_server_username }}"
      when: vnc_server_public_ssh_key|length > 0

    - name: Install SSH private key for VNC user
      ansible.builtin.copy:
        content: "{{ vnc_server_private_ssh_key }}"
        dest: "/home/{{ vnc_server_username }}/.ssh/id_{{ vnc_server_ssh_key_type | lower }}"
        mode: 0600
        owner: "{{ vnc_server_username }}"
        group: "{{ vnc_server_username }}"
      no_log: true
      when: vnc_server_private_ssh_key|length > 0

    - name: Add VNC SSH public key as authorized key
      ansible.posix.authorized_key:
        user: "{{ vnc_server_username }}"
        key: "{{ vnc_server_public_ssh_key }}"
      when:
        - vnc_server_public_ssh_key|length > 0
        - vnc_server_private_ssh_key|length > 0
