# platform = multi_platform_all
# reboot = false
# strategy = unknown
# complexity = low
# disruption = medium


- name: "Detect if user-administration-disabled can be found on /etc/dconf/db/local.d/"
  ansible.builtin.find:
    path: /etc/dconf/db/local.d/
    contains: '^\s*user-administration-disabled'
  register: dconf_gnome_disable_user_admin_config_files

- name: "Configure user-administration-disabled - default file"
  community.general.ini_file:
    dest: /etc/dconf/db/local.d//00-security-settings
    section: org/gnome/desktop/lockdown
    option: user-administration-disabled
    value: "true"
    create: yes
  when: dconf_gnome_disable_user_admin_config_files is defined and dconf_gnome_disable_user_admin_config_files.matched == 0
  register: default_file

- name: "Configure user-administration-disabled - existing files"
  community.general.ini_file:
    dest: "{{ item.path }}"
    section: org/gnome/desktop/lockdown
    option: user-administration-disabled
    value: "true"
    create: yes
  with_items: "{{ dconf_gnome_disable_user_admin_config_files.files }}"
  when: dconf_gnome_disable_user_admin_config_files is defined and dconf_gnome_disable_user_admin_config_files.matched > 0
  register: existing_files

- name: "Detect if lock for user-administration-disabled can be found on /etc/dconf/db/local.d/"
  ansible.builtin.find:
    path: /etc/dconf/db/local.d/locks
    contains: '^\s*user-administration-disabled'
  register: dconf_gnome_disable_user_admin_lock_files

- name: "Prevent user modification user-administration-disabled - default file"
  ansible.builtin.lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: '^/org/gnome/desktop/lockdown/user-administration-disabled$'
    line: '/org/gnome/desktop/lockdown/user-administration-disabled'
    create: yes
  when: dconf_gnome_disable_user_admin_lock_files is defined and dconf_gnome_disable_user_admin_lock_files.matched == 0

- name: "Prevent user modification user-administration-disabled - existing files"
  ansible.builtin.lineinfile:
    path: "{{ item.path }}"
    regexp: '^/org/gnome/desktop/lockdown/user-administration-disabled$'
    line: '/org/gnome/desktop/lockdown/user-administration-disabled'
    create: yes
  with_items: "{{ dconf_gnome_disable_user_admin_lock_files.files }}"
  when: dconf_gnome_disable_user_admin_lock_files is defined and dconf_gnome_disable_user_admin_lock_files.matched > 0

- name: "Dconf Update - user-administration-disabled"
  ansible.builtin.command: dconf update
  when: default_file is changed or existing_files is changed