- name: Create new Rainbosheep cloud user
  hosts: server
  tasks:
    - name: Create kerberos user
      ansible.builtin.command:
        cmd: "kadmin.local add_principal -pw '{{ password }}' {{ username }}"
      register: create_krb_user_out
      failed_when: create_krb_user_out.rc != 0 and create_krb_user_out.rc != 1
      changed_when: create_krb_user_out.rc == 0

    - name: Create linux group
      ansible.builtin.group:
        name: "{{ username }}"

    - name: Create linux user
      ansible.builtin.user:
        name: "{{ username }}"
        create_home: false
        group: "{{ username }}"

    - name: Create user protected repository
      ansible.builtin.file:
        path: "/srv/protected/{{ username }}"
        state: directory
        owner: "{{ username }}"
        group: "{{ username }}"
        mode: "770"

    - name: Create user vault repository
      ansible.builtin.file:
        path: "/srv/vault/{{ username }}"
        state: directory
        owner: "{{ username }}"
        group: "{{ username }}"
        mode: "770"

    - name: Init gocryptfs vault
      ansible.builtin.command:
        cmd: "gocryptfs --init /srv/vault/{{ username }}"
        stdin: "{{ password }}\n"
      register: gocryptfs_out
      failed_when: gocryptfs_out.rc != 0 and gocryptfs_out.rc != 6
      changed_when: gocryptfs_out.rc == 0

    - name: Get gocryptfs master key
      ansible.builtin.command:
        cmd: "gocryptfs-xray -dumpmasterkey /srv/vault/{{ username }}/gocryptfs.conf"
        stdin: "{{ password }}\n"
      register: master_key

    - name: Print master key
      ansible.builtin.debug:
        msg: |
          Your master key is:

            {{ master_key.stdout }}

          If the gocryptfs.conf file becomes corrupted or you ever forget your password,
          there is only one hope for recovery: The master key. Print it to a piece of
          paper and store it in a drawer.

    - name: Log master key
      ansible.builtin.debug:
        msg: "{{ gocryptfs_out }}"