---
- name: Create restricted bin directory for support user
  ansible.builtin.file:
    path: /home/support/bin
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: Create symlinks to allowed commands
  ansible.builtin.file:
    src: "{{ item.src }}"
    dest: "/home/support/bin/{{ item.name }}"
    state: link
  loop:
    - {src: '/bin/ping', name: 'ping'}
    - {src: '/usr/bin/telnet', name: 'telnet'}
    - {src: '/usr/bin/mtr', name: 'mtr'}
    - {src: '/usr/local/bin/auspex', name: 'auspex'}
    - {src: '/usr/local/bin/lazydocker', name: 'lazydocker'}
    - {src: '/usr/bin/traceroute', name: 'traceroute'}
    - {src: '/usr/bin/sudo', name: 'sudo'}
    - {src: '/usr/bin/curl', name: 'curl'}
    - {src: '/usr/bin/grep', name: 'grep'}
    - {src: '/usr/bin/tee', name: 'tee'}
    - {src: '/usr/bin/ls', name: 'ls'}

- name: Set rbash as shell for support user
  ansible.builtin.user:
    name: support
    shell: /bin/rbash
    home: /home/support

- name: Allow support user to run mtr with sudo without password
  ansible.builtin.copy:
    content: |
      support ALL=(root) NOPASSWD: /usr/bin/mtr
    dest: /etc/sudoers.d/support-mtr
    owner: root
    group: root
    mode: '0440'
    validate: 'visudo -cf %s'

- name: Allow support user to run lazydocker with sudo without password
  ansible.builtin.copy:
    content: |
      support ALL=(root) NOPASSWD: /usr/local/bin/lazydocker
    dest: /etc/sudoers.d/support-lazydocker
    owner: root
    group: root
    mode: '0440'
    validate: 'visudo -cf %s'

- name: Allow support user to run auspecs with sudo without password
  ansible.builtin.copy:
    content: |
      support ALL=(root) NOPASSWD: /usr/local/bin/auspex
    dest: /etc/sudoers.d/support-auspex
    owner: root
    group: root
    mode: '0440'
    validate: 'visudo -cf %s'

- name: Allow support user to run curl with sudo without password
  ansible.builtin.copy:
    content: |
      support ALL=(root) NOPASSWD: /usr/bin/curl
    dest: /etc/sudoers.d/support-curl
    owner: root
    group: root
    mode: '0440'
    validate: 'visudo -cf %s'

- name: Allow support user to run curl with sudo without password
  ansible.builtin.copy:
    content: |
      support ALL=(root) NOPASSWD: /usr/bin/ls
    dest: /etc/sudoers.d/support-ls
    owner: root
    group: root
    mode: '0440'
    validate: 'visudo -cf %s'


- name: Configure .bash_profile with restricted PATH
  ansible.builtin.copy:
    content: |
      PATH=/home/support/bin
      export PATH
      readonly PATH
    dest: /home/support/.bash_profile
    owner: root
    group: root
    mode: '0444'

- name: Remove write permissions from home directory
  ansible.builtin.file:
    path: /home/support
    owner: root
    group: support
    mode: '0755'
...