dotfiles/user.yml

- name: configure sudoers
  lineinfile:
    path: /etc/sudoers
    line: "{{ user.name }} ALL=(ALL) NOPASSWD:ALL"
    regexp: "^{{ user.name }}\\s+"
  become: true
  become_user: root

- name: set shell
  user:
    name: "{{ user.name }}"
    shell: /usr/bin/zsh
  become: true
  become_user: root

- set_fact:
    user_groups:
      - libvirt
      - wheel
      - vboxusers
      - wireshark
      - docker
      - sudonopw
      - games
      - kvm
  tags: [always]

- set_fact:
    user_group_name: "{{ user.group|default(user.name) }}"
  tags: [always]

- name: create user group
  group:
    name: "{{ user_group_name }}"
    state: present
  become: true
  become_user: root

- name: set groups
  user:
    name: "{{ user.name }}"
    groups: "{{ [user_group_name, 'dotfiles'] + user_groups }}"
  become: true
  become_user: root

- name: create systemd directory
  file:
    state: directory
    path: "{{ item }}"
    owner: "{{ user.name }}"
    group: "{{ user_group_name }}"
  loop:
    - "/home/{{ user.name }}/.config/"
    - "/home/{{ user.name }}/.config/systemd/"
    - "/home/{{ user.name }}/.config/systemd/user/"

# No way to use the `systemd` module here, as it needs a logind
# session. So we have to handle the symlinks for masking ourselves.
- name: disable and mask systemd user units
  file:
    state: link
    dest: "/home/{{ user.name }}/.config/systemd/user/{{ item }}"
    src: "/dev/null"
  with_items:
    - gpg-agent.socket
    - gpg-agent-browser.socket
    - gpg-agent-ssh.socket
    - gpg-agent-extra.socket

- name: create directory for getty autologin
  file:
    state: directory
    path: /etc/systemd/system/getty@tty{{ user.vt }}.service.d
    owner: root
    group: root
    mode: '0755'
  become: true
  become_user: root

- name: enable getty autologin
  copy:
    dest: /etc/systemd/system/getty@tty{{ user.vt }}.service.d/override.conf
    owner: root
    group: root
    mode: '0644'
    content: |
      [Service]
      ExecStart=
      ExecStart=-/sbin/agetty --autologin {{ user.name }} --noclear %I $TERM
  become: true
  become_user: root

- block:
  - name: load dotfile list
    include_vars:
      file: dotfiles.yml

  - name: get state of empty directories
    stat:
      path: ~/{{ item.name }}
    register: empty_dir_stat
    with_items: "{{ empty_directories }}"
    check_mode: false

  - name: remove sysmlinks
    file:
      path: "{{ item.stat.path }}"
      state: absent
    when: item.stat.exists and item.stat.islnk
    with_items: "{{ empty_dir_stat.results }}"

  - name: create empty directories for dotfiles
    file:
      state: directory
      path: ~/{{ item.name }}
      mode: "{{ item.mode | default('0755') }}"
    with_items: "{{ empty_directories }}"

  - name: link this folder to ~/.dotfiles
    file:
      state: link
      force: true
      follow: false
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
      path: "/home/{{ user.name }}/.dotfiles"
      src: "{{ playbook_dir }}"
    become: true
    become_user: root

  - name: get state of copy targets
    stat:
      path: ~/{{ item.to }}
    register: copy_stat
    when: not item.template|default(false)
    with_items: "{{ dotfiles }}"
    check_mode: false

  - name: remove invalid copy target (directories)
    file:
      path: "{{ item.stat.path }}"
      state: absent
    when:
      - not item.skipped is defined or not item.skipped
      - item.stat.exists
      - item.stat.isdir
    with_items: "{{ copy_stat.results }}"

  - name: make sure target directories exist
    file:
      state: directory
      path: "{{ (['/home', user.name, item.to]|join('/')) | dirname }}"
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
    with_items: "{{ dotfiles }}"
    become: true
    become_user: root

  - name: link dotfiles
    file:
      state: link
      force: true
      follow: false
      path: "/home/{{ user.name }}/{{ item.to }}"
      src: /var/lib/dotfiles/{{ item.from }}
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
    when: not item.template|default(false)
    with_items: "{{ dotfiles }}"
    become: true
    become_user: root

  - name: get state of template targets
    stat:
      path: ~/{{ item.to }}
    register: template_stat
    when: item.template|default(false)
    with_items: "{{ dotfiles }}"
    check_mode: false

  - name: remove invalid template target (directory or symlink)
    file:
      path: "{{ item.stat.path }}"
      state: absent
    when:
      - not item.skipped is defined or not item.skipped
      - item.stat.exists
      - not item.stat.isreg
    with_items: "{{ template_stat.results }}"

  - name: deploy dotfiles templates
    template:
      src: /var/lib/dotfiles/{{ item.from }}.j2
      dest: "/home/{{ user.name }}/{{ item.to }}"
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
      force: true
    become: true
    become_user: root
    when: item.template|default(false)
    with_items: "{{ dotfiles }}"

  - name: create directories
    file:
      state: directory
      path: "{{ item }}"
    with_items:
      - ~/tmp
      - ~/.var/lib
      - ~/.var/log
      - ~/.var/run
      - ~/.usr/lib

  - name: stat ~/bin
    stat:
      path: "/home/{{ user.name }}/bin"
    register: bin_stat
    check_mode: false

  - name: remove ~/bin if not a link
    file:
      state: absent
      path: "/home/{{ user.name }}/bin"
    when:
      - bin_stat.stat.exists
      - not bin_stat.stat.islnk

  - name: link bin directory
    file:
      state: link
      force: true
      follow: false
      path: "/home/{{ user.name }}/bin"
      src: /var/lib/dotfiles/bin
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
  tags:
    - dotfiles

- block:
  - name: create intermediate directories for vim-plug
    file:
      path: "{{ item }}"
      state: directory
    with_items:
      - ~/.local/
      - ~/.local/share/
      - ~/.local/share/nvim/
      - ~/.local/share/nvim/site/
      - ~/.local/share/nvim/site/autoload/

  - name: install vim-plug
    copy:
      src: contrib/vim-plug/plug.vim
      dest: ~/.local/share/nvim/site/autoload/plug.vim
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
      mode: "0644"

  - name: install vim plugins
    command: nvim --headless +PlugInstall +qall
    register: vim_plugin_install
    changed_when: vim_plugin_install.stderr != ""

  - name: update vim plugins
    command: nvim --headless +PlugUpdate +qall
    register: vim_plugin_update
    changed_when: vim_plugin_update.stderr != ""

  tags: [vim-plugins]

- block:
  - name: create firefox directories
    firefox_profile:
      name: "{{ item.key }}"
    loop: "{{ user.firefox_profiles | dict2items }}"
    register: firefox_profile_names

  - set_fact:
      firefox_preferences:
        browser.aboutConfig.showWarning: false
        extensions.pocket.enabled: false
        toolkit.legacyUserProfileCustomizations.stylesheets: true
        browser.contentblocking.category: "strict"
        browser.newtabpage.enabled: false
        browser.shell.checkDefaultBrowser: false
        browser.startup.homepage: "about:blank"
        privacy.trackingprotection.enabled: true
        privacy.trackingprotection.socialtracking.enabled: true
        general.smoothScroll: false

        # Restore last session on startup
        # https://support.mozilla.org/de/questions/1235263
        browser.startup.page: 3
        browser.sessionstore.resume_from_crash: true

        # "Play DRM-controlled content"
        media.eme.enabled: true

        # "Recommend (extensions|features) as you browse"
        browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons: false
        browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features: false

        # "Ask to save logins and passwords for websites"
        signon.rememberSignons: false

        # "Allow Firefox to make personalized extension recommendations"
        browser.discovery.enabled: false

        # "Allow Firefox to install and run studies"
        app.shield.optoutstudies.enabled: false

        # "Check spelling as you type"
        layout.spellcheckDefault: 0

        # Ask for download directory
        browser.download.useDownloadDir: false

        # (Try to) disable automatic update, as firefox is pulling a Windows
        app.update.auto: false
        app.update.service.enabled: false

        # remove this camera / microphone overlay when in calls or similar
        privacy.webrtc.legacyGlobalIndicator: false

  - include_role:
      name: firefox
    vars:
      firefox_profiles: "{{ {item.key: item.value} | combine({item.key: {'preferences': firefox_preferences}}, recursive=True) }}"
    loop: "{{ user.firefox_profiles | dict2items }}"
    when: not ansible_check_mode

  - name: firefox - create chrome directory
    file:
      path: "{{ item.profile_path }}/chrome/"
      state: directory
      mode: '0755'
    with_items: "{{ firefox_profile_names.results }}"
    when: not ansible_check_mode

  - name: firefox - configure firefox custom css
    copy:
      dest: "{{ item.profile_path }}/chrome/userChrome.css"
      content: |
        #TabsToolbar {
          visibility: collapse !important;
        }
        #titlebar {
          visibility: collapse !important;
        }
        #sidebar-header {
          visibility: collapse !important;
        }
    when:
      - not ansible_check_mode
      - user.firefox_profiles[item.profile_name].manage_css is sameas True
    with_items: "{{ firefox_profile_names.results }}"
  tags:
    - firefox

- name: handle autostart units
  block:
  - name: create systemd user directory
    file:
      state: directory
      path: ~/{{ item }}
    loop:
      - .config/
      - .config/systemd/
      - .config/systemd/user/

  - name: link autostart service files
    file:
      state: link
      force: true
      follow: false
      path: "/home/{{ user.name }}/.config/systemd/user/{{ item | basename }}"
      src: "{{ item }}"
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
    with_fileglob: /var/lib/dotfiles/autostart/services/*

  - name: get state of autostart.target
    stat:
      path: "/home/{{ user.name }}/.config/systemd/user/autostart.target"
    register: autostart_target_stat

  - name: remove invalid autostart.target
    file:
      path: "/home/{{ user.name }}/.config/systemd/user/autostart.target"
      state: absent
    when:
      - autostart_target_stat.stat.exists
      - not autostart_target_stat.stat.isreg

  - name: deploy autostart.target
    template:
      src: ./autostart/autostart.target.j2
      dest: "/home/{{ user.name }}/.config/systemd/user/autostart.target"
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
      force: true
      follow: false

  tags:
    - autostart

- block:
  - name: import gpg key
    command: gpg --import ./gpgkeys/{{ user.gpg_key.email }}.gpg.asc
    register: gpg_import_output
    changed_when: not ("unchanged" in gpg_import_output.stderr)

  - name: trust gpg key
    shell: "gpg --import-ownertrust <<< {{ user.gpg_key.fingerprint }}:6"
    args:
      executable: /bin/bash # required for <<<
    register: gpg_trust_output
    changed_when: gpg_trust_output.stderr_lines|length > 0

  when: user.gpg_key is defined
  tags: [gpg]

- block:
  - name: add passwordstore init script
    copy:
      dest: /home/{{ user.name }}/bin
      owner: "{{ user.name }}"
      group: "{{ user_group_name }}"
      mode: '0755'
      content: |
        #!/usr/bin/env bash

        set -o nounset
        set -o errexit

        if [[ ! -e ~/.password-store ]] ; then
          printf '%s\n' 'This is the first time running pass, initializting repository ...'

          git clone ssh://git@code.hkoerber.de:2222/hannes/passwordstore.git ~/.password-store

          printf '%s\n' 'Done'
        fi

        command -p pass "${@}"
  when: user.enable_passwordstore|default(false) is sameas true
  tags: [passwordstore]