# Account setup for an ingest kiosk

- name: Add zoox user to the plugdev group
  become: yes
  user:
    name: "{{INGEST_USER}}"
    groups: plugdev
    append: yes
  tags:
    - kiosk_account

- block:
    - name: make AWS credential directory
      file:
        path: "/home/{{INGEST_USER}}/.aws"
        state: directory
      tags:
        - kiosk_account

    - name: install aws configuration
      template:
        src: aws_config.j2
        dest: "/home/{{INGEST_USER}}/.aws/config"
      tags:
        - kiosk_account

    - name: install aws credentials
      template:
        src: aws_credentials.j2
        dest: "/home/{{INGEST_USER}}/.aws/credentials"
      tags:
        - kiosk_account

    - name: create .ssh directory
      file:
        path: "/home/{{INGEST_USER}}/.ssh"
        state: directory
      tags:
        - kiosk_account

    - name: install github credentials (private)
      copy:
        content: "{{ lookup('hashi_vault', 'secret=ingest-kiosk/data/ssh url=https://vault-rsi.zooxlabs.com:8200').data.private_key }}"
        dest: "/home/{{INGEST_USER}}/.ssh/kiosk_id_rsa"
        owner: "{{INGEST_USER}}"
        mode: u=r,g=,o=
      tags:
        - kiosk_account

    - name: install github credentials (public)
      copy:
        content: "{{ lookup('hashi_vault', 'secret=ingest-kiosk/data/ssh url=https://vault-rsi.zooxlabs.com:8200').data.public_key }}"
        dest: "/home/{{INGEST_USER}}/.ssh/kiosk_id_rsa.pub"
        owner: "{{INGEST_USER}}"
        mode: u=r,g=,o=
      tags:
        - kiosk_account

    - name: install ssh config
      copy:
        content: "{{ lookup('hashi_vault', 'secret=ingest-kiosk/data/ssh url=https://vault-rsi.zooxlabs.com:8200').data.config }}"
        dest: "/home/{{INGEST_USER}}/.ssh/config"
        owner: "{{INGEST_USER}}"
        mode: u=r,g=,o=
      tags:
        - kiosk_account

    - name: remove existing authorized keys (zaccess only now)
      file:
        path: "/home/{{INGEST_USER}}/.ssh/authorized_keys"
        state: absent
      tags:
        - kiosk_account
