---

- name: turn swap off
  become: yes
  command: "swapoff -a"
  changed_when: false

- name: remove swap apt package
  become: yes
  apt: state="absent" name="dphys-swapfile"

- name: add log2ram apt key
  become: yes
  apt_key: url="https://azlux.fr/repo.gpg.key"

- name: add log2ram apt repo
  become: yes
  apt_repository: repo="deb http://packages.azlux.fr/debian/ buster main"

- name: set timezone
  become: yes
  timezone: name="{{rpi_base_timezone}}"

- name: setup wifi
  become: yes
  template: src="wpa_supplicant.conf.j2" dest="/etc/wpa_supplicant/wpa_supplicant.conf" mode="0600"

- name: update apt package cache
  become: yes
  apt: upgrade="dist" autoremove="yes" autoclean="yes" update_cache="yes" cache_valid_time="3600"

- name: install extra apt packages
  become: yes
  apt: name="{{rpi_base_apt_packages}}" state="latest"

- name: install fail2ban config
  become: yes
  copy: src="jail.local" dest="/etc/fail2ban/jail.local"

- name: add users
  become: yes
  user:
    name: "{{admin_user_name}}"
    password: "{{admin_user_password}}"
    groups: "sudo,users"
    append: yes

- name: authorize admin ssh keys
  become: yes
  authorized_key: user="{{admin_user_name}}" key="https://github.com/{{github_user}}.keys"

- name: authorize pi ssh keys
  become: yes
  authorized_key: user="{{ansible_user}}" key="https://github.com/{{github_user}}.keys"

- name: nopasswd sudo for admin user
  become: yes
  template:
    src: "010_admin-nopasswd"
    dest: "/etc/sudoers.d/010_admin-nopasswd"

- name: disable ssh password login
  become: yes
  lineinfile:
    path: "/etc/ssh/sshd_config"
    regexp: "^PasswordAuthentication"
    insertafter: "^#PasswordAuthentication"
    line: "PasswordAuthentication no"