---
- name: Configure MOTD
  when: system_cfg.features.banner.motd | bool
  block:
    - name: Create MOTD file
      ansible.builtin.copy:
        content: |
          ********************************************************************
          * AUTHORIZED ACCESS ONLY. ALL ACTIVITIES ARE MONITORED AND LOGGED. *
          ********************************************************************
        dest: /mnt/etc/motd
        mode: "0644"
        owner: root
        group: root

    - name: Remove other MOTD files
      ansible.builtin.file:
        path: "{{ item }}"
        state: absent
      loop:
        - /mnt/etc/motd.d/99-motd
        - /mnt/etc/motd.d/cockpit
        - /mnt/etc/motd.d/insights-client
      failed_when: false

- name: Create login banner
  ansible.builtin.copy:
    dest: "{{ item }}"
    content: |
      **************************************************************
      * WARNING: Unauthorized access to this system is prohibited. *
      * All activities are monitored and logged.                   *
      * Disconnect immediately if you are not an authorized user.  *
      **************************************************************
    owner: root
    group: root
    mode: "0644"
  loop:
    - /mnt/etc/issue
    - /mnt/etc/issue.net

- name: Configure sudo banner
  when: system_cfg.features.banner.sudo | bool
  block:
    - name: Create sudo lecture file
      ansible.builtin.copy:
        content: |
          I am Groot, and I know what I'm doing.
        dest: /mnt/etc/sudo_lecture
        mode: "0644"
        owner: root
        group: root

    - name: Enable sudo lecture in sudoers
      ansible.builtin.lineinfile:
        path: /mnt/etc/sudoers
        line: "{{ item }}"
        state: present
        create: true
        mode: "0440"
        owner: root
        group: root
        validate: "/usr/sbin/visudo --check --file=%s"
      loop:
        - "Defaults lecture=always"
        - "Defaults lecture_file=/etc/sudo_lecture"