---
  - name: Get current hostname
    ansible.builtin.command: hostname
    register: hostname_result



  - name: Allow 'ansible' user passwordless sudo (temporary)
    ansible.builtin.copy:
      dest: /etc/sudoers.d/ansible
      content: "ansible ALL=(ALL) NOPASSWD:ALL\n"
      owner: root
      group: root
      mode: '0440'

  - name: Regenerate machine-id if hostname contains 'template'
    block:
      - name: Remove /etc/machine-id
        ansible.builtin.file:
          path: /etc/machine-id
          state: absent

      - name: Remove legacy /var/lib/dbus/machine-id if exists
        ansible.builtin.file:
          path: /var/lib/dbus/machine-id
          state: absent

      - name: Regenerate machine-id
        ansible.builtin.command: systemd-machine-id-setup
        args:
          creates: /etc/machine-id 
    when: "'template' in hostname_result.stdout"

  - name: Set hostname
    ansible.builtin.hostname:
      name: "{{ inventory_hostname }}"

  - name: replace hostname
    lineinfile:
      path: /etc/hosts
      regexp: '^127.0.1.1'
      line: "127.0.1.1    {{ inventory_hostname }}.{{ dns_domain }} {{ inventory_hostname }}"

  - name: System details
    debug:
      msg: "{{ ansible_distribution }}"

  - name: System details
    debug:
      msg: "{{ ansible_distribution_major_version }}"

#  - import_tasks: ipchange.yml

  - name: Copy /etc/apt/sources.list file with owner and permissions
    ansible.builtin.copy:
      src: etc/apt/sources.list
      dest: /etc/apt/sources.list
      owner: root
      group: root
      mode: '0644'
    when: (ansible_distribution == "Debian") and (ansible_distribution_major_version == "12")

  - name: Run the equivalent of "apt-get update" as a separate step
    ansible.builtin.apt:
      update_cache: yes

  - name: disable ipv6
    ansible.builtin.template:
      src: ../templates/etc/sysctl.d/90-noipv6.conf.j2
      dest: /etc/sysctl.d/90-noipv6.conf
      owner: root
      group: root
      mode: '0644'


  - name: install var packages
    apt:
      name: "{{ item }}"
      state: present
    loop:
      - vim
      - mc
      - htop
      - iotop
      - net-tools
      - moreutils
      - tcpdump
      - nmap
      - nmon
      - ethtool

  - name: Ansible delete file glob
    find:
      paths: /var/crash
      patterns: "*"
    register: files_to_delete

  - name: Ansible remove file glob
    file:
      path: "{{ item.path }}"
      state: absent
    with_items: "{{ files_to_delete.files }}"

  - name: Copy .bashrc file with owner and permissions
    ansible.builtin.copy:
      src: root/.bashrc
      dest: /root/.bashrc
      owner: root
      group: root
      mode: '0644'
      follow: yes

  - name: Copy sysctl tweak file
    ansible.builtin.copy:
      src: etc/sysctl.d/999-tweaks.conf
      dest: /etc/sysctl.d/999-tweaks.conf
      owner: root
      group: root
      mode: '0644'
      follow: yes

  - name: Reload sysctl parameters
    ansible.builtin.command: sysctl --system



  - import_tasks: ntp2.yml
  - import_tasks: rsyslog.yml
  - import_tasks: snmpd.yml
  - import_tasks: addtoobservium.yml
  - import_tasks: services.yml
  - import_tasks: vlans.yml

  - name: Revert 'ansible' sudo to require password
    ansible.builtin.copy:
      dest: /etc/sudoers.d/ansible
      content: "ansible ALL=(ALL) ALL\n"
      owner: root
      group: root
      mode: '0440'

  - name: Set plaintext password for ansible user
    ansible.builtin.user:
      name: ansible
      password: "{{ 'tOwnz8qhfn4CaLLSJ6XW' | password_hash('sha512') }}"
      update_password: always