---
- name: Update apt cache
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600

- name: Install base packages
  ansible.builtin.apt:
    name: "{{ firstrun_common_base_packages }}"
    state: present

- name: Set timezone
  community.general.timezone:
    name: "{{ timezone }}"

- name: Ensure deploy user exists
  ansible.builtin.user:
    name: "{{ deploy_user }}"
    shell: "{{ deploy_user_shell }}"
    groups: sudo
    append: true
    create_home: true

- name: Allow deploy user passwordless sudo
  ansible.builtin.copy:
    dest: "/etc/sudoers.d/{{ deploy_user }}"
    content: "{{ deploy_user }} ALL=(ALL) NOPASSWD:ALL\n"
    mode: "0440"
    validate: "visudo -cf %s"

- name: Install SSH keys for deploy user
  ansible.posix.authorized_key:
    user: "{{ deploy_user }}"
    key: "{{ ssh_key_ansible }}"

- name: Install extra host-specific packages (if defined)
  ansible.builtin.apt:
    name: "{{ extra_packages }}"
    state: present
  when: extra_packages is defined

- name: Enable unattended-upgrades
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present
  when: unattended_upgrades_enabled | bool

- name: Configure unattended-upgrades to auto-reboot if needed
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
    content: |
      Unattended-Upgrade::Automatic-Reboot "true";
      Unattended-Upgrade::Automatic-Reboot-Time "03:30";
    mode: "0644"
  when: unattended_upgrades_enabled | bool