---
# roles/container_isolation/tasks/sync_users.yml
#
# Creates each app's primary group + user, and each shared group, using
# Ansible's built-in group/user modules instead of hand-rolled file
# appends — this is idempotent and safe to re-run, and avoids the
# malformed-/etc/passwd risk of manual editing.

- name: Create primary group for each container app
  ansible.builtin.group:
    name: "{{ item.name }}"
    gid: "{{ item.uid }}"
    state: present
  loop: "{{ container_apps }}"
  loop_control:
    label: "{{ item.name }} (gid {{ item.uid }})"

- name: Create shared (secondary) groups
  ansible.builtin.group:
    name: "{{ item.name }}"
    gid: "{{ item.gid }}"
    state: present
  loop: "{{ shared_groups }}"
  loop_control:
    label: "{{ item.name }} (gid {{ item.gid }})"

- name: Create service user for each container app
  ansible.builtin.user:
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    group: "{{ item.name }}"
    shell: /usr/sbin/nologin
    home: /nonexistent
    create_home: false
    system: true
    state: present
  loop: "{{ container_apps }}"
  loop_control:
    label: "{{ item.name }} (uid {{ item.uid }})"

- name: Add app users to their shared groups
  ansible.builtin.user:
    name: "{{ item.0.name }}"
    groups: "{{ item.1.name }}"
    append: true
  loop: "{{ container_apps | product(shared_groups) | list }}"
  loop_control:
    label: "{{ item.0.name }} -> {{ item.1.name }}"
  when: item.0.name in item.1.members