main.yml

---

- name: Expand "layout" variable
  set_fact:
    layout_n: "{{ layout_n|default([]) + _layout_n|list }}"
  loop: "{{ layout | selectattr('device', 'defined') | list }}"
  vars:
    _layout_n: |-
      {%- for _item in ([item.device] if item.device is string else item.device) -%}
        {{ item | combine({'device': _item}) }},
      {%- endfor -%}

- name: Update "layout" variable
  when: layout_n | selectattr('device', 'defined') | list | length > 0
  set_fact:
    layout: "{{ layout_n }}"

- name: Get disks sizes, logical and physical sectors sizes
  command: "lsblk -d -b -O --json {{ layout | selectattr('device', 'defined') | map(attribute='device') | list | join(' ') }}"
  check_mode: no
  register: _cmd_lsblk_result

- name: Calculate some disks attributes
  when: _cmd_lsblk_result.rc is defined and _cmd_lsblk_result.rc | int == 0
  set_fact:
    device_attrs: "{{
      device_attrs|default([])
        | union([{'device': '/dev/' + item['name'],
                  'devsz_b': item['size'],
                  'lbsz_b': item['log-sec'],
                  'pbsz_b':  item['phy-sec'],
                  'last_usable_sector_s': item['size']|int / item['log-sec']|int - _efi_label_size_s,
                  'offset_s': 2048 if item['phy-sec']|int == 512 else (4096 if item['phy-sec']|int == 4096 else 0)}
                ])
    }}"
  vars:
    _efi_label_size_s: 34
  loop: "{{ _cmd_lsblk_result.stdout | from_json | dict2items | selectattr('value','defined') | map(attribute='value') | flatten(levels=1) }}"
  loop_control:
    label: "{{ item.name }}"

- name: Combine disks layouts with disks attributes
  when: item.0.device == item.1.device
  set_fact:
    layout_w_attrs: "{{ layout_w_attrs|default([]) | union([item.0 | combine(item.1)]) }}"
  loop: "{{ layout|sort(attribute='device') | zip(device_attrs|sort(attribute='device')) | list }}"

- name: Check EFI system
  when: use_efi
  stat:
    path: /sys/firmware/efi
  register: _stat_efi

- name: Check EFI mount point
  when: use_efi and _stat_efi.stat.exists
  set_fact:
    _efi_mountpoint: "{{ layout
      | selectattr('partitions', 'defined')
      | sum(attribute='partitions', start=[])
      | selectattr('mount', 'defined')
      | selectattr('mount', 'eq', '/boot/efi')
      | map(attribute='mount')
      | list
      | first
      | default(False) }}"

- name: Disable efi if there is no EFI partition
  set_fact:
    use_efi: False
  when: use_efi and _efi_mountpoint|default(False) == False

- name: Cursory variable check
  include_tasks: sanity.yml

- name: Check raw partition encryption
  set_fact:
    _encrypt: "{{ layout
      | selectattr('partitions', 'defined')
      | sum(attribute='partitions', start=[])
      | selectattr('encrypt', 'defined')
      | map(attribute='encrypt')
      | list
      | first
      | default(False) }}"

- name: Check raid partition encryption
  when: md is defined and not _encrypt
  set_fact:
    _encrypt: "{{ md
      | selectattr('encrypt', 'defined')
      | map(attribute='encrypt')
      | list
      | first
      | default(False) }}"

- name: Install newest debootstrap from impish
  apt:
    deb: http://de.archive.ubuntu.com/ubuntu/pool/main/d/debootstrap/debootstrap_1.0.124_all.deb
  when: ansible_distribution_release != "impish" and release == "impish"

- name: Install global dependencies
  apt:
    name: "{{ dependencies.global }}"
    state: latest
    update_cache: yes
    cache_valid_time: "{{ debian_cache_valid_time|default(7200) }}"

- name: check if already bootstrapped
  stat:
    path: "{{ dbstrp_mountpoint }}/root/.bootstrap_complete"
  register: _stat_mount

- set_fact:
    bootstrapped: "{{ _stat_mount.stat.exists }}"
    bootstrapped_in_chroot: "{{ _stat_mount.stat.exists }}"

- name: check if already bootstrapped
  stat:
    path: "/root/.bootstrap_complete"
  register: _stat_local

- set_fact:
    bootstrapped: "{{ _stat_local.stat.exists }}"
    bootstrapped_in_chroot: "{{ _stat_local.stat.exists }}"

- block:
    - name: print keys
      command: ssh-add -L
      delegate_to: localhost
      become: no
      changed_when: no
      register: _local_keys

    - fail:
        msg: "No keys in ssh-agent, please add your keys to the agent"
      when: _local_keys.stdout == ""

    - name: copy keys
      set_fact:
        dbstrp_ssh_keys: "{{ _local_keys.stdout_lines }}"

  delegate_to: localhost
  become: no
  when: dbstrp_ssh_keys is not defined

- block:
    # This may fail when buster-backports isn't enabled as repository, however
    # this is preferable to debootstrap failing later. This works on the Hetzner
    # rescue system which is a common use case for this author
    - name: Install debootstrap from buster-backports when on buster and eoan
      apt:
        name: debootstrap
        state: latest
        default_release: buster-backports
        cache_valid_time: "{{ debian_cache_valid_time|default(7200) }}"
        update_cache: yes
      when: ansible_distribution_release == 'buster' and release == 'eoan'

    - name: create list of target devices
      set_fact:
        _target_devices: "{{ _target_devices + [item.device] }}"
      with_items: "{{ layout }}"

    - name: wipe devices
      include_tasks: wipe.yml
      when: wipe|default('') == "ABSOLUTELY"

    - name: create mountpoint
      file:
        state: directory
        path: "{{ dbstrp_mountpoint }}"

    - name: create debootstrap user
      include_tasks: user.yml
      vars:
        _tgt_user: no

    - name: chroot user via ssh
      blockinfile:
        path: "/etc/ssh/sshd_config"
        state: present
        block: >
          Match user {{ dbstrp_user['name'] }}
              ChrootDirectory {{ dbstrp_mountpoint }}
              AuthorizedKeysFile {{ dbstrp_mountpoint }}/home/debootstrap/.ssh/authorized_keys
      register: _ssh_config

    - name: restart sshd
      service:
        name: ssh
        state: restarted
      when: _ssh_config.changed

    - name: set mountpoint
      set_fact:
        _tgt_root: "{{ dbstrp_mountpoint }}"
        _mktemp: None

    - name: Partition Devices
      include_tasks: partitions.yml

    - name: Create MD Devices
      include_tasks: md.yml
      when: md is defined and md|count > 0

    - name: encrypt devices
      include_tasks: encryption.yml
      when: _encrypt

    - name: Create logical volumes
      include_tasks: lvm.yml
      when: lvm is defined and lvm|count > 0

    - name: Create filesystems
      include_tasks: fs.yml

    - name: Create and mount ZFS pools
      include_tasks: zfs.yml
      when: zfs_pool is defined and zfs_fs is defined

    - name: mount filesystems
      include_tasks: mount.yml

    - name: run bootstrap
      include_tasks: bootstrap.yml

    - name: configure system
      include_tasks: configure.yml

    - name: create debootstrap user on target
      include_tasks: user.yml
      vars:
        _tgt_user: yes

    - name: create ssh directory for bootstrap user
      file:
        state: directory
        path: "{{ dbstrp_mountpoint }}/home/{{ dbstrp_user['name'] }}/.ssh"
        owner: "{{ dbstrp_user['name'] }}"

    - name: create ssh directory for bootstrap user on host
      file:
        state: directory
        path: "/tmp/.debootstrap-ssh"
        owner: "{{ dbstrp_user['name'] }}"
        mode: 0700

    - name: setup keys for bootstrap user
      authorized_key:
        key: "{{ item }}"
        path: "{{ dbstrp_mountpoint }}/home/{{ dbstrp_user['name'] }}/.ssh/authorized_keys"
        user: "{{ dbstrp_user['name'] }}"
      with_items: "{{ dbstrp_ssh_keys }}"

    - name: allow sudo for debootstrap user
      copy:
        dest: "{{ dbstrp_mountpoint }}/etc/sudoers.d/{{ dbstrp_user['name'] }}"
        owner: root
        group: root
        mode: 0440
        content: "{{ dbstrp_user['name'] }} ALL=(ALL) NOPASSWD:ALL"

    - name: mark as bootstrapped
      copy:
        dest: "/root/.bootstrap_complete"
        content: ""
        owner: root
        group: root
        mode: 0600

    - name: register bootstrapped fact
      set_fact:
        bootstrapped: yes

  when: not bootstrapped or wipe|default('') == "ABSOLUTELY"