---

- name: turn swap off

  become: yes

  command: "swapoff -a"

  changed_when: false

- name: remove swap apt package

  become: yes

  apt: state="absent" name="dphys-swapfile"

- name: add log2ram apt key

  become: yes

  get_url:

    url: "https://azlux.fr/repo.gpg.key"

    dest: "/etc/apt/trusted.gpg.d/log2ram.asc"

    mode: "0644"

- name: add log2ram apt repo

  become: yes

  apt_repository: repo="deb [signed-by=/etc/apt/trusted.gpg.d/log2ram.asc] https://packages.azlux.fr/debian/ buster main"

- name: set timezone

  become: yes

  timezone: name="{{rpi_base_timezone}}"

- name: setup wifi

  become: yes

  template: src="wpa_supplicant.conf.j2" dest="/etc/wpa_supplicant/wpa_supplicant.conf" mode="0600"

- name: update apt package cache

  become: yes

  apt: upgrade="dist" autoremove="yes" autoclean="yes" update_cache="yes" cache_valid_time="3600"

- name: install extra apt packages

  become: yes

  apt: name="{{rpi_base_apt_packages}}" state="latest"

- name: configure auto upgrades

  become: yes

  copy: src="20auto-upgrades" dest="/etc/apt/apt.conf.d/20auto-upgrades"

- name: configure log2ram disk size

  become: yes

  lineinfile:

    path: "/etc/log2ram.conf"

    regexp: "^SIZE="

    line: "SIZE={{rpi_base_log_size}}"

  notify: restart log2ram service

- name: configure fail2ban

  become: yes

  copy: src="jail.local" dest="/etc/fail2ban/jail.local"

- name: add users

  become: yes

  user:

    name: "{{admin_user_name}}"

    password: "{{admin_user_password}}"

    groups: "sudo,users"

    shell: "/bin/bash"

    append: yes

- name: authorize admin ssh keys

  become: yes

  authorized_key: user="{{admin_user_name}}" key="https://github.com/{{github_user}}.keys"

- name: authorize ssh keys

  become: yes

  authorized_key: user="{{ansible_user}}" key="https://github.com/{{github_user}}.keys"

- name: nopasswd sudo for admin user

  become: yes

  template:

    src: "010_admin-nopasswd"

    dest: "/etc/sudoers.d/010_admin-nopasswd"

- name: disable ssh password login

  become: yes

  lineinfile:

    path: "/etc/ssh/sshd_config"

    regexp: "^PasswordAuthentication"

    insertafter: "^#PasswordAuthentication"

    line: "PasswordAuthentication no"