---
- hosts: all
  become: true

  vars:
    created_username: my_username
    ssh_key_path: "/home/my_local_username/.ssh/id_ed25519.pub"
    arch: amd64

  tasks:
    - name: Setup passwordless sudo
      lineinfile:
        path: /etc/sudoers
        state: present
        regexp: '^%sudo'
        line: '%sudo ALL=(ALL) NOPASSWD: ALL'
        validate: '/usr/sbin/visudo -cf %s'

    - name: Create a new regular user with sudo privileges
      user:
        name: "{{ created_username }}"
        state: present
        groups: sudo
        append: true
        create_home: true
        shell: /usr/bin/bash

    - name: Set authorized key for remote user
      ansible.posix.authorized_key:
        user: "{{ created_username }}"
        state: present
        key: "{{ lookup('file', ssh_key_path) }}"

    - name: Disable password login
      lineinfile:
        path: /etc/ssh/sshd_config
        state: present
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
      loop:
        - { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no'}
        - { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no'}
      register: sshd_conf

    - name: Update apt and install required system packages
      apt:
        pkg:
          - curl
          - ufw
        state: latest
        update_cache: true

    - name: UFW - Allow SSH connections
      community.general.ufw:
        rule: allow
        name: OpenSSH

    - name: UFW - Enable and deny by default
      community.general.ufw:
        state: enabled
        default: deny

    - name: UFW - Enable systemd service
      service:
        name: ufw
        enabled: true
        state: started

    - name: Restart sshd
      service:
        name: sshd
        state: restarted
      when: sshd_conf.changed

    - name: Download 3x-ui bundle
      get_url:
        url: https://github.com/MHSanaei/3x-ui/releases/latest/download/x-ui-linux-{{ arch }}.tar.gz
        dest: /tmp

    - name: Clean previous installation
      file:
        path: '{{ item }}'
        state: absent
      become: true
      loop:
        - x-ui/
        - /usr/local/x-ui/
        - /usr/bin/x-ui
        - /etc/systemd/system/x-ui.service

    - name: Unarchive
      unarchive:
        src: /tmp/x-ui-linux-{{ arch }}.tar.gz
        dest: /tmp
        remote_src: yes

    - name: Make executable
      file:
        path: '/tmp/{{ item }}'
        mode: 0755
      loop:
        - x-ui/x-ui
        - x-ui/bin/xray-linux-{{ arch }}
        - x-ui/x-ui.sh

    - name: Copy the files
      copy:
        src: '/tmp/{{ item.src }}'
        dest: '{{ item.dest }}'
        remote_src: true
        mode: preserve
      become: true
      loop:
        - {src: x-ui/x-ui.sh, dest: /usr/bin/x-ui}
        - {src: x-ui/x-ui.service, dest: /etc/systemd/system}
        - {src: x-ui, dest: /usr/local}

    - name: Enable and start systemd service
      systemd_service:
        name: x-ui
        enabled: true
        state: restarted
        daemon_reload: true
      become: true

    - name: Clean up
      file:
        path: '/tmp/{{ item }}'
        state: absent
      loop:
        - x-ui
        - x-ui-linux-{{ arch }}.tar.gz