---
- name: Create group
  ansible.builtin.group:
    name: weblog
    system: true

- name: Create user
  ansible.builtin.user:
    name: weblog
    comment: Service weblog
    create_home: false
    group: weblog
    home: /var/empty
    shell: /sbin/nologin

- name: Create authorized_keys
  ansible.builtin.copy:
    dest: /etc/ssh/authorized_keys.weblog
    src: ../files/ssh/weblog.pub
    mode: "0640"
    owner: root
    group: weblog

- name: Configure sshd chroot
  ansible.builtin.blockinfile:
    path: /etc/ssh/sshd_config
    block: |
      Match User weblog
        ChrootDirectory /var/www/logs
        ForceCommand internal-sftp
        AuthorizedKeysFile /etc/ssh/authorized_keys.weblog
    marker: "# {mark} ANSIBLE MANAGED BLOCK (user weblog)"
    validate: "sshd -t -f %s"
  notify: Restart sshd