---
# ---
# - default user/groups
# ---

# To be precise, samba groups are system groups.
#
- name: (samba-user.yml) Ensure samba groups exists
  ansible.builtin.group:
    name: "{{ item.name }}"
    state: present
    gid: "{{ item.group_id | default(omit) }}"
  loop: "{{ samba_groups }}"
  loop_control:
    label: "{{ item.name }}"
  when: item.group_id is defined
  tags:
    - samba-server
    - samba-group
    - system-group

# get all user of the system
#
# Note:
#    the result ist avalable in variable getent_passwd
#
- name: (samba_user.yml) Get database of (system) users
  ansible.builtin.getent:
    database: passwd
  tags:
    - samba-server
    - samba-user
    - system-user

# Samba users mut be also system users
#
- name: (samba_user.yml) Add (system) users if not yet exists..
  ansible.builtin.command:
    cmd: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
    creates: "/home/{{ item.name }}"
  loop: "{{ samba_user }}"
  loop_control:
    label: "{{ item.name }}"
  when:
    - ansible_facts.getent_passwd is defined
    - item.name not in ansible_facts.getent_passwd
  changed_when: true
  tags:
    - samba-server
    - samba-user
    - system-user

- name: (samba_user.yml) Ensure samba users exists in system with given group membership
  ansible.builtin.user:
    name: "{{ item.name }}"
    state: present
    uid: "{{ item.user_id | default(omit) }}"
    # group: '{{ item.0.name | default(omit) }}'
    groups: "{{ item.groups | join(', ') }}"
    password: "{{ item.password | password_hash('sha512') }}"
    update_password: on_create
    append: true
  loop: "{{ samba_user }}"
  loop_control:
    label: "{{ item.name }}"
  tags:
    - samba-server
    - samba-user
    - system-user

- name: (samba-user.yml) Check if samba user exists
  ansible.builtin.shell:
    executable: /bin/bash
    cmd: |
      set -o pipefail
      pdbedit -w -L | awk -F":" '{ print $1 }' | grep -e "^{{ item.name }}"
  register: common_samba_user_present
  changed_when: "common_samba_user_present.rc == 1"
  failed_when: "common_samba_user_present.rc > 1"
  loop: "{{ samba_user }}"
  loop_control:
    label: "{{ item.name }}"
  tags:
    - samba-server
    - samba-user

- name: (samba-user.yml) Add user to samba (with system users password)  # noqa no-handler
  ansible.builtin.shell:
    executable: /bin/bash
    cmd: |
      set -o pipefail
      (echo '{{ item.item.password }}'; echo '{{ item.item.password }}') | smbpasswd -s -a {{ item.item.name }}
  loop: "{{ common_samba_user_present.results }}"
  when: item.changed
  loop_control:
    label: "{{ item.item.name }}"
  changed_when: true
  tags:
    - samba-server
    - samba-user

# Only on fileservers:
#   zapata.opp.netz

- name: (samba_user.yml) Check if folder '/data/backup'  exists using file module
  ansible.builtin.stat:
    path: /data/backup
  register: common_data_backup_dir
  when:
    - inventory_hostname == 'zapata.opp.netz'
  tags:
    - samba-server
    - samba-user
    - system-user

- name: (samba_user.yml) Ensure folder /data/backup/<user-name> exists for all (samba) users on host zapata
  ansible.builtin.file:
    path: "/data/backup/{{ item.name }}"
    state: directory
    owner: "{{ item.name }}"
    group: "{{ item.name }}"
    mode: "2770"
  loop: "{{ samba_user }}"
  loop_control:
    label: "{{ item.name }}"
  when:
    - inventory_hostname == 'zapata.opp.netz'
    - common_data_backup_dir.stat.isdir is defined and common_data_backup_dir.stat.isdir
  tags:
    - samba-server
    - samba-user
    - system-user