---
- block:
  - name: Ubuntu | Install prerequisites
    apt:
      name: "{{ item }}"
      update_cache: true
    with_items:
      - python2.7
      - sudo

  - name: Ubuntu | Configure defaults
    alternatives:
      name: python
      link: /usr/bin/python
      path: /usr/bin/python2.7
      priority: 1
    tags:
      - update-alternatives
  vars:
    ansible_python_interpreter: /usr/bin/python3

- name: Gather facts
  setup:

- name: Cloud only tasks
  block:
    - name: Install software updates
      apt:
        update_cache: true
        install_recommends: true
        upgrade: dist

    - name: Check if reboot is required
      shell: >
        if [[ -e /var/run/reboot-required ]]; then echo "required"; else echo "no"; fi
      args:
        executable: /bin/bash
      register: reboot_required

    - name: Reboot
      shell: sleep 2 && shutdown -r now "Ansible updates triggered"
      async: 1
      poll: 0
      when: reboot_required is defined and reboot_required.stdout == 'required'
      ignore_errors: true

    - name: Wait until SSH becomes ready...
      local_action:
        module: wait_for
        port: 22
        host: "{{ inventory_hostname }}"
        search_regex: OpenSSH
        delay: 10
        timeout: 320
      when: reboot_required is defined and reboot_required.stdout == 'required'
      become: false
  when: algo_provider != "local"

- name: Include unatteded upgrades configuration
  import_tasks: unattended-upgrades.yml

- name: Disable MOTD on login and SSHD
  replace: dest="{{ item.file }}" regexp="{{ item.regexp }}" replace="{{ item.line }}"
  with_items:
    - { regexp: '^session.*optional.*pam_motd.so.*', line: '# MOTD DISABLED', file: '/etc/pam.d/login' }
    - { regexp: '^session.*optional.*pam_motd.so.*', line: '# MOTD DISABLED', file: '/etc/pam.d/sshd' }

- name: Loopback for services configured
  template:
    src: 10-algo-lo100.network.j2
    dest: /etc/systemd/network/10-algo-lo100.network
  notify:
    - restart systemd-networkd
  tags:
    - always

- name: systemd services enabled and started
  systemd:
    name: "{{ item }}"
    state: started
    enabled: true
    daemon_reload: true
  with_items:
    - systemd-networkd
    - systemd-resolved
  tags:
    - always

- meta: flush_handlers
  tags:
    - always

- name: Check apparmor support
  shell: apparmor_status
  ignore_errors: yes
  register: apparmor_status

- set_fact:
    apparmor_enabled: true
  when: '"profiles are in enforce mode" in apparmor_status.stdout'

- set_fact:
    tools:
      - git
      - screen
      - apparmor-utils
      - uuid-runtime
      - coreutils
      - iptables-persistent
      - cgroup-tools
      - "openssl{% if install_headers|default(true)|bool %},linux-headers-{{ ansible_kernel }}{% endif %}"
    sysctl:
      - item: net.ipv4.ip_forward
        value: 1
      - item: net.ipv4.conf.all.forwarding
        value: 1
      - item: net.ipv6.conf.all.forwarding
        value: 1
  tags:
    - always

- name: Install tools
  package: name="{{ item }}" state=present
  with_items:
    - "{{ tools|default([]) }}"
  tags:
    - always