---
- name: "install container {{ container_name }}"
  community.general.lxd_container:
    name: "{{ container_name }}"
    state: started
    profiles: default
    wait_for_ipv4_addresses: true
    source:
      type: image
      mode: pull
      server: "{{ img_server }}"
      protocol: simplestreams
      alias: "{{ alp_img_alias }}"
    devices:
      eth0:
        type: nic
        nictype: bridged
        parent: "{{ lxd_bridge }}"
        ipv4.address: "{{ container_ip }}"

- name: update container packages
  command: "{{ lxc_cmd }} exec {{ container_name }} -- apk upgrade -U"

- name: install openssh, rsync, and shadow packages in containers
  command: "{{ lxc_cmd }} exec {{ container_name }} -- \
        apk add openssh rsync shadow python3"

- name: "copy container sshd_config for {{ container_name }} to lxd host"
  template:
    src: templates/sshd_config.j2
    dest: "{{ tmp_sshd_config }}"

- name: use lxc file push to get sshd_config into container
  command: "{{ lxc_cmd }} file push {{ tmp_sshd_config}} \
        {{ container_name }}/etc/ssh/sshd_config"

- name: mkdir /root/.ssh in {{ container_name }}
  command: "{{ lxc_cmd }} exec {{ container_name }} -- mkdir -p /root/.ssh"

- name: add controller public key to {{ container_name }} authorized keys
  command: "{{ lxc_cmd }} file push {{ tmp_pubkey }} \
        {{ container_name }}/root/.ssh/authorized_keys \
        --gid 0 --uid 0 --mode 600"

- name: make hash of a random password
  set_fact:
    root_pass: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') | password_hash('sha512') }}"

- name: "set password to unlock root account (NOTE: still using pubkey only)"
  shell: '{{ lxc_cmd }} exec {{ container_name }} -- usermod -p {{ root_pass }} root'

- name: ensure sshd service is enabled
  command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-update add sshd"

- name: ensure sshd service is started
  command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-service sshd start"