---
- name: Install user SSH public key on managed hosts
  hosts: servers
  gather_facts: false
  vars:
    homelab_user_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
    homelab_user_pubkey: "{{ lookup('file', homelab_user_pubkey_file) }}"
  tasks:
    - name: Install user SSH key for connection user
      ansible.posix.authorized_key:
        user: "{{ ansible_user }}"
        key: "{{ homelab_user_pubkey }}"
        state: present

    - name: Install user SSH key for root
      ansible.posix.authorized_key:
        user: root
        key: "{{ homelab_user_pubkey }}"
        state: present
      become: true
      when: ansible_user != 'root'

- name: Bootstrap user SSH public key into legacy LXC containers via Proxmox
  hosts: pve_nodes
  gather_facts: false
  vars:
    homelab_user_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
    homelab_user_pubkey: "{{ lookup('file', homelab_user_pubkey_file) }}"
    legacy_lxc_key_targets:
      - node: cloud-pc
        vmid: 120
        name: pbs
  tasks:
    - name: Install user SSH key for root inside legacy LXC
      ansible.builtin.shell: |
        pct exec {{ item.vmid }} -- sh -c '
          key=$(printf "%s" {{ homelab_user_pubkey | b64encode | quote }} | base64 -d)
          mkdir -p /root/.ssh
          chmod 700 /root/.ssh
          touch /root/.ssh/authorized_keys
          if grep -qxF "$key" /root/.ssh/authorized_keys; then
            echo present
          else
            printf "%s\n" "$key" >> /root/.ssh/authorized_keys
            echo added
          fi
          chmod 600 /root/.ssh/authorized_keys
        '
      loop: "{{ legacy_lxc_key_targets }}"
      when: item.node == inventory_hostname
      register: legacy_lxc_key_install
      changed_when: "'added' in legacy_lxc_key_install.stdout"