---
- name: Verify gpg-agent is running
  ansible.builtin.command:
    cmd: gpg-agent --version
  changed_when: false
  register: ssh_gpg_agent_check
  failed_when: ssh_gpg_agent_check.rc != 0

- name: Ensure .ssh directory exists
  ansible.builtin.file:
    path: "{{ ansible_facts['user_dir'] }}/.ssh"
    state: directory
    mode: "0700"

- name: Write ansible SSH private key
  ansible.builtin.copy:
    content: "{{ lookup('pipe', 'pass show ssh/id_ed25519_ansible') }}\n"
    dest: "{{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible"
    mode: "0600"
  no_log: true

- name: Derive and write ansible SSH public key
  ansible.builtin.shell:
    cmd: ssh-keygen -y -f {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible > {{ ansible_facts['user_dir'] }}/.ssh/id_ed25519_ansible.pub
  changed_when: false

- name: Deploy SSH config
  ansible.builtin.template:
    src: config.j2
    dest: "{{ ansible_facts['user_dir'] }}/.ssh/config"
    mode: "0600"

- name: Fetch Gitea host key
  ansible.builtin.command:
    cmd: ssh-keyscan -4 -p 2222 gitea.learningunix.net
  register: ssh_gitea_host_key
  changed_when: false

- name: Add Gitea host key to known_hosts
  ansible.builtin.known_hosts:
    name: "[gitea.learningunix.net]:2222"
    key: "{{ item }}"
    path: "{{ ansible_facts['user_dir'] }}/.ssh/known_hosts"
    state: present
  loop: "{{ ssh_gitea_host_key.stdout_lines | reject('match', '^#') | list }}"