---


- name: Create group for user {{ dehydrated_username }}
  group:
    name: "{{ dehydrated_usergroup }}"


- name: Create user for {{ dehydrated_username }}
  user:
    name: "{{ dehydrated_username }}"
    home: "{{ dehydrated_userhome }}"
    group: "{{ dehydrated_usergroup }}"


- name: Set paranoid umask for user
  lineinfile:
    dest: "{{ dehydrated_userhome }}/.profile"
    regexp: "^#?umask"
    line: "umask 0077 # paranoid umask, we're creating private keys "


- name: Create configuration directory {{ dehydrated_configdir }}
  file:
    path: "{{ dehydrated_configdir }}"
    state: directory
    owner: "{{ dehydrated_username }}"
    group: "{{ dehydrated_usergroup }}"
    mode: 0700


- name: Create acme-challenges directory {{ dehydrated_challengesdir }}
  file:
    path: "{{ dehydrated_challengesdir }}"
    state: directory
    owner: "{{ dehydrated_username }}"
    group: "{{ dehydrated_usergroup }}"
    mode: 0755  # This folder must be readable by webserver

---


- name: Create group for user {{ dehydrated_username }}
  group:
    name: "{{ dehydrated_usergroup }}"


- name: Create user for {{ dehydrated_username }}
  user:
    name: "{{ dehydrated_username }}"
    home: "{{ dehydrated_userhome }}"
    group: "{{ dehydrated_usergroup }}"


- name: Set paranoid umask for user
  lineinfile:
    dest: "{{ dehydrated_userhome }}/.profile"
    regexp: "^#?umask"
    line: "umask 0077 # paranoid umask, we're creating private keys "
    create: yes


- name: Create configuration directory {{ dehydrated_configdir }}
  file:
    path: "{{ dehydrated_configdir }}"
    state: directory
    owner: "{{ dehydrated_username }}"
    group: "{{ dehydrated_usergroup }}"
    mode: 0700


- name: Create acme-challenges directory {{ dehydrated_challengesdir }}
  file:
    path: "{{ dehydrated_challengesdir }}"
    state: directory
    owner: "{{ dehydrated_username }}"
    group: "{{ dehydrated_usergroup }}"
    mode: 0755  # This folder must be readable by webserver

Create .profile if it does not exist
Create .profile if it does not exist
