---
- name: Setup OpenBSD Laptop
  hosts: localhost
  vars:
    ansible_connection: local
    openbsd_staff:
      - mitch
    openbsd_sysctls:
      - line: hw.smt=1
        regexp: ^hw.smt
      - line: kern.maxproc=32768
        regexp: ^kern.maxproc
      - line: kern.maxfiles=65535
        regexp: ^kern.maxfiles
      - line: kern.bufcachepercent=40
        regexp: ^kern.bufcachepercent
      - line: kern.audio.record=1
        regexp: ^kern.audio.record
    openbsd_doas: |
      permit nopass :wheel as root
    openbsd_packages:
      - git
      - ansible
      - vim
      - firefox
      - neofetch
      - evolution
      - seahorse
      - claws-mail
      - gnome-keyring
      - libgnome-keyring
      - tango-icon-theme
      - tango-icon-theme-extras
      - i3
      - xfce
      - i3
      - dmenu
      - password-store
      - pass-otp
      - gpa
      - htop
      - slock
      - bash
      - feh
      - rsync
      - go
      - xfce4-screenshooter
      - okular
      - shellcheck
      - redshift
      - postgresql-server
      - vlc
      - rtorrent
      - mktorrent
      - wget
      - pwgen
      - xdotool
      - runit
      - tree
      - noto-emoji
      - ncdu
      - jq
      - arandr
      # Deve stuff
      - gmake
      # pidgin plugins
      - gettext-tools
    openbsd_pf_conf: |
      #	$OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
      #
      # See pf.conf(5) and /etc/examples/pf.conf

      dns_server="100.64.1.2"

      set skip on lo

      # For vm nat
      match out on egress from 100.64.0.0/10 to any nat-to (egress)
      pass out from 100.64.0.0/10
      pass in proto { udp tcp } from 100.64.0.0/10 to any port domain

      block return	# block stateless traffic
      pass		# establish keep-state

      # By default, do not permit remote connections to X11
      block return in on ! lo0 proto tcp to port 6000:6010

      # Port build user does not need network
      block return out log proto {tcp udp} user _pbuild

  tasks:
  # TODO: login.conf staff group bumped limits
  - name: Enable apmd
    lineinfile:
      dest: /etc/rc.conf.local
      line: apmd_flags=-A
      regexp: '^apmd_flags='
  - name: Install packages
    openbsd_pkg:
      name: '{{openbsd_packages}}'
      state: present
    tags:
      - packages
  - name: Add specified users to staff
    shell: |
      #!/bin/sh
      {% for user in openbsd_staff %}
      usermod -G staff {{user}}
      {% endfor %}
  - name: Write doas configuration
    copy:
      content: '{{openbsd_doas}}'
      dest: /etc/doas.conf
  - name: Write pf configuration
    copy:
      content: '{{openbsd_pf_conf}}'
      dest: /etc/pf.conf
      mode: '0600'
  - name: Tune sysctls
    lineinfile:
      dest: /etc/sysctl.conf
      regexp: '{{item.regexp}}'
      line: '{{item.line}}'
    loop: '{{openbsd_sysctls}}'
    tags:
      - sysctls