---
- name: Bootstrap CachyOS workstation
  hosts: cachy
  connection: local

  tasks:
    - name: Install tailscale
      community.general.pacman:
        name: tailscale
        state: present
      become: true

    - name: Enable and start tailscaled
      ansible.builtin.service:
        name: tailscaled
        state: started
        enabled: true
      become: true

    - name: Clone GPG keys repo
      ansible.builtin.git:
        repo: cjr@192.168.0.194:/home/cjr/git/keys
        dest: "{{ ansible_facts['user_dir'] }}/.gpg-keys"
        update: true
        version: main
        accept_hostkey: true

    - name: Import GPG public key
      ansible.builtin.command:
        cmd: gpg --import {{ ansible_facts['user_dir'] }}/.gpg-keys/public-key.asc
      register: gpg_import_public
      changed_when: "'imported' in gpg_import_public.stderr"

    - name: Import GPG secret key
      ansible.builtin.command:
        cmd: gpg --import {{ ansible_facts['user_dir'] }}/.gpg-keys/secret-key.asc
      register: gpg_import_secret
      changed_when: "'imported' in gpg_import_secret.stderr"
      no_log: true

    - name: Remove cloned GPG keys
      ansible.builtin.file:
        path: "{{ ansible_facts['user_dir'] }}/.gpg-keys"
        state: absent

    - name: Clone password store
      ansible.builtin.git:
        repo: cjr@192.168.0.194:/home/cjr/.password-store
        dest: "{{ ansible_facts['user_dir'] }}/.password-store"
        update: true
        version: main
        accept_hostkey: true

    - name: Authenticate Tailscale
      ansible.builtin.command:
        cmd: tailscale up --auth-key={{ lookup('pipe', 'pass show tailscale/auth-key') }}
      become: true
      no_log: true
      changed_when: true