---

- name: Set default password
  ansible.builtin.set_fact:
    lxc_root_password: "new-lxc-test" 

- name: Prompt for password
  ansible.builtin.pause:
    prompt: "Enter password (letters, digits, hyphens, dots; max 253 chars) [new-lxc-test]"
    echo: false
  register: password_result_1
  until: >
    password_result_1.user_input | length == 0 or
    (
      password_result_1.user_input | length <= 253 and
      password_result_1.user_input is regex('^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$')
    )
  retries: 3
  delay: 0

- name: Prompt for password (confirmation) 
  ansible.builtin.pause:
    prompt: "Confirm your new password"
    echo: no
  register: password_result_2

- name: Ensure passwords match
  ansible.builtin.assert:
    that:
      - password_result_1.user_input == password_result_2.user_input
    fail_msg: "Passwords do not match!"
    success_msg: "Password confirmed."

- name: Use user input only if provided, otherwise keep the default
  ansible.builtin.set_fact:
    lxc_root_password: "{{ password_result_1.user_input }}"
  when: password_result_1.user_input | length > 0