user.yml

---
- name: Create clawdbot system user
  ansible.builtin.user:
    name: clawdbot
    comment: "Clawdbot Service User"
    system: true
    shell: /bin/bash
    create_home: true
    home: /home/clawdbot
    state: present

- name: Add clawdbot user to sudoers with NOPASSWD
  ansible.builtin.copy:
    dest: /etc/sudoers.d/clawdbot
    mode: '0440'
    owner: root
    group: root
    content: |
      # Allow clawdbot user to run sudo without password
      clawdbot ALL=(ALL) NOPASSWD: ALL
    validate: /usr/sbin/visudo -cf %s

- name: Set clawdbot user as primary user for installation
  ansible.builtin.set_fact:
    clawdbot_user: clawdbot
    clawdbot_home: /home/clawdbot

# Fix DBus issues for systemd user services
- name: Get clawdbot user ID
  ansible.builtin.command: id -u clawdbot
  register: clawdbot_uid
  changed_when: false
  when: ansible_os_family == 'Debian'

- name: Display clawdbot user ID
  ansible.builtin.debug:
    msg: "Clawdbot user ID: {{ clawdbot_uid.stdout }}"
  when: ansible_os_family == 'Debian'

- name: Enable lingering for clawdbot user (allows systemd user services without login)
  ansible.builtin.command: loginctl enable-linger clawdbot
  changed_when: false
  when: ansible_os_family == 'Debian'

- name: Create runtime directory for clawdbot user
  ansible.builtin.file:
    path: "/run/user/{{ clawdbot_uid.stdout }}"
    state: directory
    owner: clawdbot
    group: clawdbot
    mode: '0700'
  when: ansible_os_family == 'Debian'

- name: Store clawdbot UID as fact for later use
  ansible.builtin.set_fact:
    clawdbot_uid_value: "{{ clawdbot_uid.stdout }}"
  when: ansible_os_family == 'Debian'

# SSH key configuration
- name: Create .ssh directory for clawdbot user
  ansible.builtin.file:
    path: "{{ clawdbot_home }}/.ssh"
    state: directory
    owner: clawdbot
    group: clawdbot
    mode: '0700'

- name: Add SSH authorized keys for clawdbot user
  ansible.posix.authorized_key:
    user: clawdbot
    state: present
    key: "{{ item }}"
  loop: "{{ clawdbot_ssh_keys }}"
  when: clawdbot_ssh_keys | length > 0

- name: Display SSH key configuration status
  ansible.builtin.debug:
    msg: "✅ {{ clawdbot_ssh_keys | length }} SSH key(s) configured for clawdbot user"
  when: clawdbot_ssh_keys | length > 0

- name: Display SSH key warning if none configured
  ansible.builtin.debug:
    msg: "⚠️  No SSH keys configured. Set 'clawdbot_ssh_keys' variable to allow SSH access."
  when: clawdbot_ssh_keys | length == 0

- name: Set XDG_RUNTIME_DIR in .bashrc for clawdbot user
  ansible.builtin.lineinfile:
    path: /home/clawdbot/.bashrc
    line: 'export XDG_RUNTIME_DIR=/run/user/$(id -u)'
    state: present
    create: true
    owner: clawdbot
    group: clawdbot
    mode: '0644'
  when: ansible_os_family == 'Debian'

- name: Set DBUS_SESSION_BUS_ADDRESS in .bashrc for clawdbot user
  ansible.builtin.blockinfile:
    path: /home/clawdbot/.bashrc
    marker: "# {mark} ANSIBLE MANAGED BLOCK - DBus config"
    block: |
      # DBus session bus configuration
      if [ -z "$DBUS_SESSION_BUS_ADDRESS" ]; then
        if [ -f "${XDG_RUNTIME_DIR}/bus" ]; then
          export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"
        fi
      fi
    create: true
    owner: clawdbot
    group: clawdbot
    mode: '0644'
  when: ansible_os_family == 'Debian'