---
- name: Ensure user exists
  ansible.builtin.user:
    name: "{{ username }}"
    password: "{{ userpass | password_hash('sha512') }}"
    shell: /bin/bash
    state: present
    create_home: yes
  when: useraction == "add"

- name: Create .ssh directory
  ansible.builtin.file:
    path: "/home/{{ username }}/.ssh"
    state: directory
    owner: "{{ username }}"
    group: "{{ username }}"
    mode: '0700'
  when: useraction == "add"

- name: Upload authorized SSH key
  ansible.builtin.copy:
    src: "files/sshkeys/{{ userkey }}"
    dest: "/home/{{ username }}/.ssh/authorized_keys"
    owner: "{{ username }}"
    group: "{{ username }}"
    mode: '0600'
  when: useraction == "add"

# REMOVE USER
#- name: Remove user and home directory
#  ansible.builtin.user:
#    name: "{{ username }}"
#    state: absent
#    remove: yes
#  when: useraction == "remove"

- name: Allow {{ username }} to switch to 'docker' user without password
  ansible.builtin.copy:
    dest: "/etc/sudoers.d/{{ username }}-su-docker"
    content: "{{ username }} ALL=(ALL) NOPASSWD: /bin/su - docker"
    owner: root
    group: root
    mode: '0440'
  when: useraction == "add"

- name: Find processes owned by the user (initial)
  ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true"
  register: user_process_list
  changed_when: false
  when: useraction == "remove"

- name: Display processes owned by user before killing
  ansible.builtin.debug:
    msg: "{{ item }}"
  loop: "{{ user_process_list.stdout_lines }}"
  when: useraction == "remove"


- name: Extract PIDs of user processes
  ansible.builtin.shell: "pgrep -u {{ username }} || true"
  register: user_pids
  changed_when: false
  when: useraction == "remove"

- name: Kill user processes (if any)
  ansible.builtin.shell: "kill -9 {{ user_pids.stdout_lines | join(' ') }}"
  when:
    - useraction == "remove"
    - user_pids.stdout != ""

- name: Remove user and home directory
  ansible.builtin.user:
    name: "{{ username }}"
    state: absent
    remove: yes
  when: useraction == "remove"

- name: List remaining processes for the user (after kill)
  ansible.builtin.shell: "ps -u {{ username }} -o pid,comm,args --no-headers || true"
  register: remaining_procs
  changed_when: false
  when: useraction == "remove"

- name: Display remaining processes (manual check)
  ansible.builtin.debug:
    msg: |
      Remaining processes for '{{ username }}' after kill:
      {{ remaining_procs.stdout | default('None') }}
  when: useraction == "remove"