---

###
# this check must be repeated for each user
# even if it's been done before

- name: Fetch SSHd config files
  ansible.builtin.command:
    cmd: "find /etc/ssh -type f \\( -name 'sshd_config' -o -path '/etc/ssh/sshd_config.d/*.conf' \\)"
  changed_when: False
  check_mode: no
  register: _ssh_config_paths

- name: verify AllowGroups directive
  ansible.builtin.command:
    cmd: "grep --extended-regexp --recursive --files-with-matches '^AllowGroups' {{ _ssh_config_paths.stdout_lines | join(' ') }}"
  changed_when: False
  failed_when: False
  check_mode: no
  register: grep_allowgroups_ssh

###

- name: "Add AllowGroups sshd directive with '{{ evolinux_ssh_group }}' (Debian < 12)"
  ansible.builtin.lineinfile:
    dest: /etc/ssh/sshd_config
    line: "\nAllowGroups {{ evolinux_ssh_group }}"
    insertafter: 'Subsystem'
    validate: '/usr/sbin/sshd -t -f %s'
  notify: reload sshd
  when:
    - ansible_distribution_major_version is version('11', '<=')
    - grep_allowgroups_ssh.rc == 1 # Not found

- name: "Add AllowGroups sshd directive with '{{ evolinux_ssh_group }}' (Debian >= 12)"
  ansible.builtin.lineinfile:
    dest: /etc/ssh/sshd_config.d/z-evolinux-users.conf
    line: "\nAllowGroups {{ evolinux_ssh_group }}"
    validate: '/usr/sbin/sshd -t -f %s'
    create: yes
  notify: reload sshd
  when:
    - ansible_distribution_major_version is version('12', '>=')
    - grep_allowgroups_ssh.rc == 1 # Not found

- name: "Append '{{ evolinux_ssh_group }}' to AllowGroups sshd directive"
  ansible.builtin.replace:
    dest: "{{ grep_allowgroups_ssh.stdout_lines[0] }}"
    regexp: '^(AllowGroups ((?!\b{{ evolinux_ssh_group }}\b).)*)$'
    replace: '\1 {{ evolinux_ssh_group }}'
    validate: '/usr/sbin/sshd -t -f %s'
  notify: reload sshd
  when:
    - grep_allowgroups_ssh.rc == 0 or grep_allowgroups_ssh.rc == 2 # Found, return code can be 0 or 2