---
- name: >-
    Deny access after number of consecutive authentication
    failures num {{ pam_pwd_deny }}
  lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^deny=.*$
    line: deny={{ pam_pwd_deny }}
    state: present
    backup: true

- name: Re-enable access after the lock out seconds {{ pam_pwd_unlock_time }}
  lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^unlock_time=.*$
    line: unlock_time={{ pam_pwd_unlock_time }}
    state: present
    backup: true

- name: Set option silent in /etc/security/faillock.conf
  lineinfile:
    path: /etc/security/faillock.conf
    line: silent
    state: present
    backup: true

- name: Ensure authselect is installed
  package:
    name: authselect
    state: present

# I use the command module because I don't know a better alternative
# to configure authselect
- name: List authselect profiles
  command: authselect list
  register: __pam_pwd_authselect_list
  changed_when: false

# - name: Dump __pam_pwd_authselect_list
#   debug:
#     msg: "{{ __pam_pwd_authselect_list }}"

- name: >
    Create custom authselect profile
    from existing profile sssd {{ pam_pwd_policy_name }}
  command: authselect create-profile {{ pam_pwd_policy_name }} -b sssd
  notify: Pam_pwd_authselect_apply
  when: not pam_pwd_policy_name in __pam_pwd_authselect_list.stdout
  changed_when: true

- name: List authselect current profile
  command: authselect current
  register: __pam_pwd_authselect_current
  failed_when: __pam_pwd_authselect_current.rc not in [0, 2]
  changed_when: false

# - name: Dump __pam_pwd_authselect_current
#   debug:
#     msg: "{{ __pam_pwd_authselect_current }}"

# I use the command module because I don't know a better alternative
# to configure authselect
- name: Select profile {{ pam_pwd_policy_name }}
  command: authselect select --force custom/{{ pam_pwd_policy_name }}
  notify: Pam_pwd_authselect_apply
  when: not pam_pwd_policy_name in __pam_pwd_authselect_current.stdout
  changed_when: true

- name: List authselect current profile
  command: authselect current
  register: __pam_pwd_authselect_features
  changed_when: false

- name: Set enable-feature with-faillock
  command: authselect enable-feature with-faillock
  notify: Pam_pwd_authselect_apply
  when: not "with-faillock" in __pam_pwd_authselect_features.stdout
  changed_when: true

- name: Keep history of the last passwords used num {{ pam_pwd_history }}
  lineinfile:
    path: "{{ item }}"
    insertafter: '^.*pam_pwquality.so.*$'
    firstmatch: true
    line: >-
      password    requisite     pam_pwhistory.so remember={{ pam_pwd_history }}
      use_authtok
    state: present
    backup: true
  with_items:
    - /etc/authselect/custom/{{ pam_pwd_policy_name }}/system-auth
    - /etc/authselect/custom/{{ pam_pwd_policy_name }}/password-auth

- name: Enforce root for password complexity
  lineinfile:
    path: "{{ item }}"
    regexp: ^password\s*requisite\s*pam_pwquality\.so\s*local_users_only.*$
    line: >-
      password    requisite     pam_pwquality.so try_first_pass local_users_only
      retry=3 authtok_type= {{ pam_pwd_enforce_root }}
    state: present
    backup: true
  with_items:
    - /etc/authselect/custom/{{ pam_pwd_policy_name }}/system-auth
    - /etc/authselect/custom/{{ pam_pwd_policy_name }}/password-auth
  when:
    - pam_pwd_enforce_root is defined
    - pam_pwd_enforce_root | length > 0
