---
- name: Validate emergency access endpoint input
  ansible.builtin.assert:
    that:
      - emergency_reverse_public_key | length > 0
    fail_msg: Configure the mini-pc reverse SSH client before ru-vps.
  no_log: true

- name: Create restricted reverse SSH endpoint user
  ansible.builtin.user:
    name: "{{ emergency_reverse_user }}"
    system: true
    # Remote forwarding is accepted before a session exists. A valid shell is
    # required by SSHD; the forced command below rejects every session.
    shell: /bin/sh
    create_home: true

- name: Authorize only the dedicated reverse SSH key
  ansible.posix.authorized_key:
    user: "{{ emergency_reverse_user }}"
    key: "command=\"/usr/bin/false\",restrict,port-forwarding,permitlisten=\"{{ emergency_reverse_bind_address }}:{{ emergency_reverse_port }}\" {{ emergency_reverse_public_key }}"
    state: present
    exclusive: true
  no_log: true