- block:

  - name: Purge unneeded packages
    apt:
      name:
        - snapd
        - cloud-init
        - uwsgi
        - landscape-client
        - open-vm-tools
        - speech-dispatcher
        - apparmor
        - apparmor-utils
        - avahi-daemon
      state: absent
      purge: yes

  - name: Remove getty configuration
    file:
      path: /etc/init/ttyS0.conf
      state: absent

  - name: Create tftpboot directories
    file:
      path: "{{ item }}"
      state: directory
    with_items:
      - "/grub"
      - "/etc/zoox/"
      - "/root/lvm_stub_directory"

  - name: Install packages
    apt:
      name:
        - openssh-server
        - curl
        - efibootmgr
        - mdadm
        - lvm2
        - ethtool
        - vim
        - dosfstools
        - efibootmgr
        - parted
        - pciutils
        - nmap
        - overlayroot
        - ifstat
        - tmux
      install_recommends: no
      cache_valid_time: "{{ apt_cache_valid_time }}"

  - name: Configure overlayroot
    copy:
      content: 'overlayroot="tmpfs"'
      dest: "/etc/overlayroot.local.conf"

  - name: Install fstab
    copy:
      src: fstab
      dest: "/etc/fstab"

  - name: Set initramfs.conf
    copy:
      src: initramfs.conf
      dest: "/etc/initramfs-tools/initramfs.conf"
    notify: Update initramfs

  - name: Add driver for Anker USB-Ethernet dongle to initramfs for PXE boot
    lineinfile:
      line: r8152
      path: "/etc/initramfs-tools/modules"
    notify: Update initramfs

  # This artifact was created by running:
  # $ grub-mknetdir --net-directory=/tmp/grub --subdir=/grub --directory=/usr/lib/grub/x86_64-efi --modules=all_video
  # The default trusty grub has issues with the I350 driver ("couldn't send network packet"),
  # so grub/x86_64-efi/core.efi was replaced with xenial's.
  - name: Install grub
    unarchive:
      remote_src: yes
      src: "https://artifactory.zooxlabs.com/artifactory/RSI/imaging/grub_netdir.tar.gz"
      dest: "/"

  - name: Install grub config
    template:
      src: "grub.cfg"
      dest: "/grub/grub.cfg"

  - name: Set hostname
    copy:
      content: zoox-imaging
      dest: "/etc/hostname"

  - name: Set root password (to allow password login)
    shell: "echo root:zoox | chpasswd"

  # so that sudo doesn't complain
  - name: Add zoox-imaging to /etc/hosts
    lineinfile:
      regexp: '^127(\.[\d]{1,3}){3}\s*zoox-imaging'
      line: "127.0.1.1       zoox-imaging"
      dest: "/etc/hosts"
      insertbefore: BOF

  - name: Disable lvm scan
    lineinfile:
      regexp: '^(\s*)scan\s*=.*'
      line: '\1scan = [''/root/lvm_stub_directory'']'
      dest: "/etc/lvm/lvm.conf"
      backrefs: yes

  - name: Install udev sata count script
    copy:
      src: udev_sata_count.sh
      dest: "/usr/local/bin/udev_sata_count.sh"

  - name: Install udev rules for scsi disks
    copy:
      src: 99-zoox-imaging.rules
      dest: "/etc/udev/rules.d/99-zoox-imaging.rules"

  - name: Update initramfs script to handle nfs_interface_mac
    copy:
      src: functions
      dest: "/usr/share/initramfs-tools/scripts/functions"
    notify: Update initramfs

  - name: Configure mdadm
    copy:
      src: mdadm.conf
      dest: "/etc/mdadm/mdadm.conf"
    notify: Update initramfs

  - name: Install sshd config
    copy:
      src: sshd_config
      dest: "/etc/ssh/sshd_config"

  - name: Install ssh keys
    copy:
      content: "{{ lookup('hashi_vault_cache', 'secret=secret/ssh/zoox-imaging')[item.field] }}"
      dest: "/etc/ssh/{{ item.file }}"
      mode: "{{ item.mode }}"
    loop:
      - { file: 'ssh_host_rsa_key.pub', field: 'host_rsa_public', mode: '644' }
      - { file: 'ssh_host_rsa_key', field: 'host_rsa_private', mode: '600' }

  # The imaging server will use the zoox-imaging key to ssh into the tftpboot OS.
  - name: Set up authorized keys
    authorized_key:
      user: "root"
      path: "/root/.ssh/authorized_keys"
      key: "{{ lookup('hashi_vault_cache', 'secret=secret/ssh/zoox-imaging')['client_rsa_public'] }}"
      manage_dir: yes

  # By default, vmlinuz has permissions 600, which prevents it from being served over tftp.
  # Do NOT use the ansible 'file' module because it converts relative paths to absolute paths.
  - name: Set permissions on initrd and vmlinuz
    command: "chmod 644 {{ item }}"
    with_items:
      - "/vmlinuz"
      - "/initrd.img"

  become: yes
