---

- name: Set or unset root password
  block:
  - name: Set root password
    ansible.builtin.user:
      name: root
      password: "{{ root.password | password_hash('sha512') }}"
      password_lock: false
    when: root.password is defined and root.password | length > 0 and root.password != "!"
    no_log: true

  - name: Update ansible_become_pass
    ansible.builtin.set_fact:
      ansible_become_pass: "{{ root.password }}"
    when: root.password is defined and root.password | length > 0 and root.password != "!"
    no_log: true

  - name: Lock root login
    ansible.builtin.user:
      name: root
      password_lock: true
    when: root.password is defined and root.password | length <= 0

- name: Create .ssh directory
  ansible.builtin.file:
    path: "/root/.ssh"
    state: directory
    owner: "root"
    group: "root"
    mode: "0700"

- name: "Create authorized_keys file"
  ansible.builtin.template:
    src: root/.ssh/authorized_keys.j2
    dest: "/root/.ssh/authorized_keys"
    owner: "root"
    group: "root"
    mode: "0600"
  when: root.ssh is defined and
        root.ssh.authorized_keys is defined and
        root.ssh.authorized_keys | length > 0

- name: "Remove authorized_keys file"
  ansible.builtin.file:
    path: "/root/.ssh/authorized_keys"
    state: absent
  when: root.ssh is defined and
        root.ssh.authorized_keys is defined and
        root.ssh.authorized_keys | length <= 0 or
        root.ssh is defined and
        root.ssh.authorized_keys is not defined or
        root.ssh is not defined

- name: "Create private and public SSH key"
  when: root.ssh is defined and
        root.ssh.private_keys is defined and
        root.ssh.private_keys | length > 0
  block:
  - name: "Create private SSH keys"
    ansible.builtin.copy:
      content: "{{ item.content }}"
      dest: "/root/.ssh/{{ item.filename }}"
      owner: "root"
      group: "root"
      mode: "0600"
    loop: "{{ root.ssh.private_keys }}"
    loop_control:
      label: "{{ item.filename }}"

  - name: "Extract public SSH keys from private keys"
    ansible.builtin.command:
      argv: [ "ssh-keygen", "-y", "-f", "/root/.ssh/{{ item.filename }}" ]
    register: _root_ssh_pub_key_extraction
    changed_when: false
    loop: "{{ root.ssh.private_keys }}"
    loop_control:
      label: "{{ item.filename }}"

  - name: "Write derived public SSH keys"
    ansible.builtin.copy:
      content: "{{ item.stdout }}\n"
      dest: "/root/.ssh/{{ item.item.filename }}.pub"
      owner: "root"
      group: "root"
      mode: "0644"
    loop: "{{ _root_ssh_pub_key_extraction.results }}"
    loop_control:
      label: "{{ item.item.filename }}"

- name: "Create custom SSH client config"
  ansible.builtin.template:
    src: root/.ssh/config.j2
    dest: /root/.ssh/config
    owner: "root"
    group: "root"
    mode: "0644"
  when: root.ssh.config is defined and root.ssh.config | length >= 0

- name: "Remove custom SSH client config"
  ansible.builtin.file:
    path: "/root/.ssh/config"
    state: absent
  when: root.ssh.config is not defined