- hosts: radicle-multi
  remote_user: debian
  become: yes
  roles:
    - role: sane_debian_system
    - role: sshd
    - role: comfortable-debian-system
    - role: unix_users
    - role: liw
  tasks:
    - name: "disable access to seed.radicle.garden in DNS"
      lineinfile:
        path: /etc/hosts
        regex: seed.radicle.garden
        line: 127.0.0.1 seed.radicle.garden

    - name: "disable access to seed.radicle.xyz in DNS"
      lineinfile:
        path: /etc/hosts
        regex: seed.radicle.xyz
        line: 127.0.0.1 seed.radicle.xyz

    - name: "install important additional packages"
      apt:
        name:
          - curl
          - jq
          - moreutils
          - radicle
  vars:
    ansible_python_interpreter: /usr/bin/python3

    sane_debian_system_version: 2
    sane_debian_system_hostname: "{{ inventory_hostname }}"
    sane_debian_system_codename: bookworm
    sane_debian_system_timezone: Europe/Helsinki
    sane_debian_system_sources_lists:
      - repo: |
          deb http://security.debian.org/debian-security bookworm-security main contrib non-free
      - repo: deb http://apt.liw.fi/debian unstable main
        signing_key: "{{ apt_liw_fi_signing_key }}"

    unix_users_version: 2
    unix_users:
      - username: liw
        comment: Lars Wirzenius
        sudo: yes

    sshd_version: 1