infra/roles/common/tasks/main.yml

---
- name: Enable crb on CentOS
  shell:
    cmd: dnf config-manager --set-enabled crb
  changed_when: false
  when:
    - ansible_distribution == "CentOS"


- name: Check for EPEL Repo on CentOS
  shell:
    cmd: rpm -q epel-release
  changed_when: false
  failed_when: false
  register: epel_check
  when:
    - ansible_distribution == "CentOS"


- name: Query latest EPEL RPM File
  shell:
    cmd: curl -s https://dl.fedoraproject.org/pub/epel/{{ ansible_distribution_major_version }}/Everything/x86_64/Packages/e/ | grep epel-release | tail -n1 | grep -oP 'href="\K[^"]+'
  changed_when: false
  failed_when: false
  register: epel_rpm
  when:
    - ansible_distribution == "CentOS"
    - epel_check.rc|int == 1


- name: Enable EPEL Repo on CentOS 9+
  dnf:
    name:
      - https://dl.fedoraproject.org/pub/epel/{{ ansible_distribution_major_version }}/Everything/x86_64/Packages/e/{{ epel_rpm.stdout }}
    state: present
    disable_gpg_check: yes
  when:
    - ansible_distribution == "CentOS"
    - epel_check.rc|int == 1


- name: Check for RPMFusion rpms
  shell:
    cmd: rpm -q rpmfusion-free-release
  failed_when: false
  changed_when: false
  register: rpmfusion_check

- name: Download RPMFusion .rpms 
  get_url:
    url: "{{ item }}"
    dest: /home/ansible/{{ item | basename }}
    owner: ansible
    group: ansible
    mode: '0644'
  loop:
    - https://download1.rpmfusion.org/free/{{ 'el' if ansible_distribution == 'CentOS' else 'fedora' }}/rpmfusion-free-release-{{ ansible_distribution_major_version }}.noarch.rpm 
    - https://download1.rpmfusion.org/nonfree/{{ 'el' if ansible_distribution == 'CentOS' else 'fedora' }}/rpmfusion-nonfree-release-{{ ansible_distribution_major_version }}.noarch.rpm 
  loop_control:
    label: "{{ item | basename }}"
  register: rpmfusion_repos
  when:
    - ansible_distribution == 'CentOS' or ansible_distribution == 'Fedora'
    - rpmfusion_check.rc != "0"


- name: Install RPMFusion .rpms
  yum:
    name: 
      - /home/ansible/rpmfusion-free-release-{{ ansible_distribution_major_version }}.noarch.rpm
      - /home/ansible/rpmfusion-nonfree-release-{{ ansible_distribution_major_version }}.noarch.rpm
    disable_gpg_check: yes
    state: present
  when:
    - rpmfusion_repos is defined
    - rpmfusion_repos.changed
    - ansible_distribution == 'CentOS' or ansible_distribution == 'Fedora'


- name: Combine Packages (RPM)
  set_fact:
    all_pkgs: "{{ all_pkgs | default([]) | union(item) }}"
  loop:
    - "{{ common_pkgs }}"
    - "{{ common_pkgs_rpm }}"
    - "{{ host_pkgs | default([]) }}"
  loop_control:
    label: "{{ all_pkgs | default([]) | length }} Packages"
  when:
    - ansible_distribution == 'CentOS' or ansible_distribution == 'Fedora'


- name: Combine Packages (DEB)
  set_fact:
    all_pkgs: "{{ all_pkgs | default([]) | union(item) }}"
  loop:
    - "{{ common_pkgs }}"
    - "{{ common_pkgs_deb }}"
    - "{{ host_pkgs | default([]) }}"
  when:
    - ansible_distribution == 'Ubuntu' or ansible_distribution == 'Debian'


- name: Install packages
  package:
    name: "{{ all_pkgs }}"
    state: present
  when:
    - all_pkgs is defined


- name: Install ansible SSH keys
  authorized_key:
    user: ansible
    state: present
    exclusive: yes
    key: "{{ ssh_ansible_keys | join('\n') }}"
  when:
    - ansible_os_family != 'LibreELEC'
  tags: ssh


- name: Install root SSH keys
  authorized_key:
    user: root
    state: present
    exclusive: yes
    key: "{{ ssh_root_keys | union(host_ssh_root_keys) | join('\n') }}"
  tags: ssh


- name: Create additional users
  user:
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    state: present
    shell: "{{ item.shell | default('/bin/bash') }}"
    create_home: "{{ item.create_home | default('yes') }}"
  with_items:
    - "{{ users }}"
  when:
    - item.name is defined
    - item.uid is defined


- name: Add Bash aliases for root user
  lineinfile:
    dest: /root/.bashrc
    create: yes
    mode: '0644'
    line: "alias {{ item.alias }}='{{ item.command }}'"
    regexp: "^alias {{ item.alias }}="
  with_items:
    - "{{ common_bash_aliases | default('') }}"
    - "{{ host_bash_aliases | default('') }}"
  when:
    - (item.user is not defined or item.user == 'root')
    - item.alias is defined
    - item.command is defined
    - ansible_os_family != 'LibreELEC'
  tags: aliases


- name: Add bash aliases for non-root users
  lineinfile:
    dest: /home/{{ item.user }}/.bashrc
    create: no
    mode: '0644'
    line: "alias {{ item.alias }}='{{ item.command }}'"
    regexp: "^alias {{ item.alias }}="
  register: create_alias
  failed_when:
    - create_alias.rc is defined
    - create_alias.rc != 257
  with_items:
    - "{{ common_bash_aliases | default('') }}"
    - "{{ host_bash_aliases | default('') }}"
  when:
    - item.user is defined
    - item.user != 'root'
    - item.alias is defined
    - item.command is defined
    - ansible_os_family != 'LibreELEC'
  tags: aliases


- name: Enforce .bash_profile
  ansible.builtin.template:
    src: bash_profile.j2
    dest: /root/.bash_profile
    owner: root
    group: root
    mode: '0640'


- name: Enforce .bashrc aliases for ll (Debian)
  ansible.builtin.lineinfile:
    path: /root/.bashrc
    regexp: "{{ item.regexp }}"
    line: "{{ item.line }}"
  loop:
    - { 'regexp': '^#?\s*export LS_OPTIONS=',    'line': "export LS_OPTIONS='--color=auto'" }
    - { 'regexp': '^#?\s*eval \"$(dircolors)\"', 'line': "eval \"$(dircolors)\"" }
    - { "regexp": '^#?\s*alias ls=',             'line': "alias ls='ls $LS_OPTIONS'" }
    - { "regexp": '^#?\s*alias ll=',             'line': "alias ll='ls $LS_OPTIONS -lh'" }
    - { "regexp": '^#?\s*alias l=',              'line': "alias l='ls $LS_OPTIONS -lA'" }
  when:
    - ansible_distribution == 'Debian'