---
# Git-over-SSH uses the host's sshd on port 22, and the shim reaches the container through a one-command sudoers rule.
- name: Ensure the git group exists
  ansible.builtin.group:
    name: "{{ git_user }}"
  become: true

# sshd runs the forced command through the login user's shell, so it must not be nologin; the uid is left to the system.
- name: Add the git login user
  ansible.builtin.user:
    name: "{{ git_user }}"
    comment: Gitea SSH login user
    group: "{{ git_user }}"
    home: "{{ git_home }}"
    shell: /bin/bash
    create_home: true
  become: true


- name: Install the git-over-SSH passthrough shim
  ansible.builtin.template:
    src: gitea.j2
    dest: "{{ shim_path }}"
    owner: root
    group: root
    mode: '0755'
  become: true

- name: Install the container exec wrapper
  ansible.builtin.template:
    src: gitea-container-exec.j2
    dest: "{{ podman_exec_wrapper }}"
    owner: root
    group: root
    mode: '0755'
  become: true

- name: Install the authorized_keys hook sshd runs for the git user
  ansible.builtin.template:
    src: gitea-authorized-keys.j2
    dest: "{{ authorized_keys_command }}"
    owner: root
    group: root
    mode: '0755'
  become: true

# A syntax error in /etc/sudoers.d breaks every sudo on the host, so validate before installing.
- name: Let the git user reach the container as {{ podman_user }}
  ansible.builtin.template:
    src: sudoers-gitea.j2
    dest: "{{ sudoers_path }}"
    owner: root
    group: root
    mode: '0440'
    validate: /usr/sbin/visudo -cf %s
  become: true

- name: Point sshd at Gitea's authorized_keys
  block:
    - name: Install the sshd drop-in for the git user
      ansible.builtin.template:
        src: sshd-gitea.conf.j2
        dest: "{{ sshd_dropin_path }}"
        owner: root
        group: root
        mode: '0644'
      register: gitea_sshd_dropin
      become: true

    # A drop-in that does not parse locks everyone out on the next reboot, so validate it and remove the file if it fails.
    - name: Validate the resulting sshd configuration
      ansible.builtin.command: /usr/sbin/sshd -t
      changed_when: false
      become: true
      when: gitea_sshd_dropin.changed
  rescue:
    - name: Take the sshd drop-in back out
      ansible.builtin.file:
        path: "{{ sshd_dropin_path }}"
        state: absent
      become: true

    - name: Fail
      ansible.builtin.fail:
        msg: >-
          {{ sshd_dropin_path }} did not validate, so it has been removed and
          sshd is still running — and still restarting — on its previous
          configuration. Run `/usr/sbin/sshd -t` on the host to see why.

# A reload re-execs sshd without dropping the connection this play runs over.
- name: Reload sshd
  ansible.builtin.systemd_service:
    name: "{{ sshd_service }}"
    state: reloaded
  become: true
  when: gitea_sshd_dropin.changed