# 
# Task: Create User
#
# - create new User 
# - optional input ip for remote access 
# - remote ip will also add to ufw 
#

- name: Input IP
  pause:
    prompt: "Remote IP?"
  register: remote_ip

- name: Input Dbname
  pause:
    prompt: "Dbname?"
  register: mariadb_dbname

#
# create username
#
- name: create username
  set_fact:
    mariadb_username: "user{{ lookup('community.general.random_string', length=16, upper=false, special=false) }}"

#
#
#
- name: create password
  set_fact:
    mariadb_password: "{{ lookup('ansible.builtin.password', '~/' + mariadb_username + '.txt', length=24, chars=['ascii_lowercase', 'digits']) }}"

#
# create user for localhast
#
- name: create user
  community.mysql.mysql_query:
    login_db: "mysql"
    login_unix_socket: "{{ mariadb_socket }}"
    query: 
      - CREATE USER {{ mariadb_username }}@'localhost' IDENTIFIED BY '{{ mariadb_password }}'
      - GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER,DROP ON {{ mariadb_dbname.user_input }}.* TO {{ mariadb_username }}@localhost

#
# create user for remote ip
#
- name: create user for remote
  community.mysql.mysql_query:
    login_db: "mysql"
    login_unix_socket: "{{ mariadb_socket }}"
    query: 
      - CREATE USER {{ mariadb_username }}@'{{ remote_ip.user_input }}' IDENTIFIED BY '{{ mariadb_password }}' REQUIRE SSL
      - GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER,DROP ON {{ mariadb_dbname.user_input }}.* TO {{ mariadb_username }}@'{{ remote_ip.user_input }}' REQUIRE SSL
  when: remote_ip.user_input | regex_search('^[0-9]+.[0-9]+.[0-9]+.[0-9]+$')

#
# add rule in ufw for remote ip 
#
- name: Allow IP for remote access
  ufw:
    rule: allow 
    from_ip: "{{ remote_ip.user_input }}"
    port: 3306
  when: remote_ip.user_input | regex_search('^[0-9]+.[0-9]+.[0-9]+.[0-9]+$')