---
- name: Acquiring home of current user
  when: ansible_facts["system"] == "Linux"
  ansible.builtin.shell:
    cmd: "echo ~{{ ansible_user }}"
  register: ansible_user_home
- name: Acquiring home of current user
  when: ansible_facts["system"] == "Linux"
  ansible.builtin.shell:
    cmd: "echo {{ ansible_user }}"
  register: current_user
- name: Setting up TOTP using Google Authenticator
  become: true
  become_user: "{{ current_user.stdout }}"
  ansible.builtin.command:
    argv:
      - "google-authenticator"
      - "-t"
      - "-d"
      - "-f"
      - "-C"
      - "-q"
      - "-l {{ ansible_user }}@{{ inventory_hostname }}"
      - "-i {{ inventory_hostname }}"
      - "--qr-mode=NONE"
      - "-r 7"
      - "-R 300"
      - "-w 9"
    creates: "{{ ansible_user_home.stdout }}/.google_authenticator"
- name: Pausing to inquire about how to proceed
  ansible.builtin.pause:
    prompt: "Type \"fetch\" to get the TOTP secret and backup codes, or \"show\" to see it for manual copying instead"
    echo: true
  register: data_method
- name: Choosing to present TOTP secret and backup codes to Control Node
  when: data_method.user_input == "show"
  block:
    - name: Acquiring contents of file containing TOTP secret and backup codes
      ansible.builtin.slurp:
        src: "{{ ansible_user_home.stdout }}/.google_authenticator"
      register: totp_token
    - name: Presenting TOTP secret and backup codes to Control Node
      ansible.builtin.debug:
        msg: "Make sure to store the following TOTP secret and backup codes for Google Authenticator:\n {{ totp_token.content | b64decode }}"
    - name: Giving opportunity to manually copy TOTP secret and backup codes 
      ansible.builtin.pause:
- name: Choosing to provide file on control node containing TOTP secret and backup codes
  when: data_method.user_input == "fetch"
  block:
    - name: Placing TOTP secret and backup codes into file on control node
      ansible.builtin.fetch:
        src: "{{ ansible_user_home.stdout }}/.google_authenticator"
        dest: "./.tmp/{{ inventory_hostname }}-google-auth/google_auth.secret"
        flat: true
    - name: Informing control node of acquired files
      ansible.builtin.debug:
        msg: "The TOTP secret and backup codes file has been duplicated to './.tmp/{{ inventory_hostname }}-google-auth/google-auth.secret' at the control node."
    - name: Giving control node user time to read the aforementiioned message
      ansible.builtin.pause:
        seconds: 30
- name: Adding Google Authenticator OTP module PAM authentication line for SSH 
  become: true
  ansible.builtin.lineinfile:
    path: /etc/pam.d/sshd
    line: "auth    sufficient    pam_google_authenticator.so nullok"
    insertafter: "include common-auth$"
    owner: root
    group: root
    mode: "644"
- name: Prioritizing authentication methods in SSH
  become: true
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config.d/auth.conf
    line: "KbdInteractiveAuthentication yes # enable if implementing TOTP 2FA"
    regexp: "^KbdInteractiveAuthentication"
    owner: root
    group: root
    mode: "644"
- name: Prioritizing authentication methods in SSH
  become: true
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config.d/auth.conf
    line: "AuthenticationMethods publickey keyboard-interactive:pam"
    insertafter: "^KbdInteractiveAuthentication"
    owner: root
    group: root
    mode: "644"
# - name: Adding Google Authenticator OTP module PAM authentication line for SSH 
#   become: true
#   ansible.builtin.lineinfile:
#     path: /etc/pam.d/sudo
#     line: "auth    required    pam_google_authenticator.so nullok"
#     insertafter: "include common-auth$"
#     owner: root
#     group: root
#     mode: "644"
# - name: Adding Google Authenticator OTP module PAM authentication line for SSH 
#   become: true
#   ansible.builtin.lineinfile:
#     path: /etc/pam.d/su
#     line: "auth    required    pam_google_authenticator.so nullok"
#     insertafter: "include common-auth$"
#     owner: root
#     group: root
#     mode: "644"
- name: Restarting SystemD SSH service 
  become: true
  ansible.builtin.systemd_service:
    name: sshd
    state: restarted