---
# roles/container_isolation/tasks/jerick_access.yml
#
# jerick needs read-write access across every app folder for admin/
# maintenance purposes, without weakening isolation between apps from
# each other. Achieved by making jerick a secondary member of every
# app's primary group, combined with 770 permissions on app folders
# (see nfs_folders.yml) — owner: full access, group (incl. jerick):
# full access, others: none.

- name: Check whether jerick exists on this host (read-only, does not create the account)
  ansible.builtin.getent:
    database: passwd
    key: "{{ jerick_user }}"
  register: jerick_lookup
  failed_when: false

- name: Warn if jerick user does not exist on this host
  ansible.builtin.debug:
    msg: >-
      WARNING: user '{{ jerick_user }}' was not found on this host.
      This role does not create jerick's account (assumed to be a
      pre-existing human user, not a service account). Create it first,
      then re-run this role so jerick gets added to the app groups below.
  when: jerick_lookup.failed | default(false)

- name: Add jerick to every app's primary group
  ansible.builtin.user:
    name: "{{ jerick_user }}"
    groups: "{{ item.name }}"
    append: true
  loop: "{{ container_apps }}"
  loop_control:
    label: "{{ jerick_user }} -> {{ item.name }}"
  when: not (jerick_lookup.failed | default(false))

- name: Add jerick to every shared group
  ansible.builtin.user:
    name: "{{ jerick_user }}"
    groups: "{{ item.name }}"
    append: true
  loop: "{{ shared_groups }}"
  loop_control:
    label: "{{ jerick_user }} -> {{ item.name }}"
  when: not (jerick_lookup.failed | default(false))