---
- name: Install the package for strong password checking
  ansible.builtin.apt:
    name: libpam-passwdqc
    state: present
    update_cache: true
  when:
    - os_auth_pam_passwdqc_enable

- name: Configure passwdqc
  ansible.builtin.template:
    src: usr/share/pam-configs/pam_passwdqc.j2
    dest: "{{ passwdqc_path }}"
    mode: "0644"
    owner: root
    group: root
  when:
    - os_auth_pam_passwdqc_enable

- name: Install tally2
  ansible.builtin.apt:
    name: libpam-modules
    state: present
  when:
    - os_auth_retries|int > 0

- name: Manage tally on Debian stable
  when:
    - "'libpam-modules' in ansible_facts.packages"
    - ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')
  block:
    - name: Configure tally2
      ansible.builtin.template:
        src: usr/share/pam-configs/pam_tally2.j2
        dest: "{{ tally2_path }}"
        mode: "0644"
        owner: root
        group: root
      when:
        - os_auth_retries|int > 0

    - name: Delete tally2 when retries is 0
      ansible.builtin.file:
        path: "{{ tally2_path }}"
        state: absent
      when:
        - os_auth_retries|int == 0

- name: Manage tally/faillock on Debian unstable
  when:
    - "'libpam-modules' in ansible_facts.packages"
    - ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')
  block:
    - name: Delete tally2
      ansible.builtin.file:
        path: "{{ tally2_path }}"
        state: absent

    - name: Create tally directory
      ansible.builtin.file:
        path: /var/run/faillock
        state: directory
        mode: "0755"
        owner: root
        group: root

    - name: Configure faillock
      ansible.builtin.template:
        src: etc/security/faillock.conf.j2
        dest: /etc/security/faillock.conf
        mode: "0644"
        owner: root
        group: root

    - name: Configure faillock pam
      ansible.builtin.template:
        src: usr/share/pam-configs/pam_faillock.j2
        dest: /usr/share/pam-configs/faillock
        mode: "0644"
        owner: root
        group: root
      when:
        - os_auth_retries|int > 0

    - name: Configure faillock pam authfail
      ansible.builtin.template:
        src: usr/share/pam-configs/pam_faillock_authfail.j2
        dest: /usr/share/pam-configs/faillock_authfail
        mode: "0644"
        owner: root
        group: root
      when:
        - os_auth_retries|int > 0

    - name: Delete faillock when retries is 0
      ansible.builtin.file:
        path: /usr/share/pam-configs/faillock
        state: absent
      when:
        - os_auth_retries|int == 0

    - name: Delete faillock authfail when retries is 0
      ansible.builtin.file:
        path: /usr/share/pam-configs/faillock_authfail
        state: absent
      when:
        - os_auth_retries|int == 0

- name: Update pam on Debian systems
  ansible.builtin.command: pam-auth-update --package
  environment:
    DEBIAN_FRONTEND: noninteractive
  changed_when: false

- name: Remove passwdqc
  ansible.builtin.apt:
    name: libpam-passwdqc
    state: absent
  when:
    - not os_auth_pam_passwdqc_enable

- name: Allow Login with SSH Keys, when user password is expired
  ansible.builtin.lineinfile:
    path: /etc/pam.d/common-account
    backrefs: true
    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
    line: '\1 no_pass_expiry'