---
  #
  # Install rspamd and relevant packages
  #
- name: Setup rspamd with redis
  tags: rspamd
  become: true

  block:
  - name: install essantial tools
    ansible.builtin.apt:
      pkg:
        - lsb-release
        - wget
        - gpg

  - name: add the rspamd apt key
    ansible.builtin.apt_key:
      url: https://rspamd.com/apt-stable/gpg.key
      state: present

  - name: add rspamd repository
    ansible.builtin.apt_repository:
      repo: "deb [arch=amd64] http://rspamd.com/apt-stable/ {{ ansible_distribution_release }} main"
      state: present
      filename: rspamd

  - name: install rspamd and redis-server
    ansible.builtin.apt:
      pkg:
        - rspamd
        - redis-server

  #
  # Setup and configure rspamd
  #
  - name: Template worker-controller.inc
    ansible.builtin.template:
      src: templates/worker-controller.j2
      dest: /etc/rspamd/local.d/worker-controller.inc
    notify: reload rspamd.service

  - name: Copy basic configuration
    ansible.builtin.template:
      src: "templates/basic_conf/{{ item }}.j2"
      dest: "/etc/rspamd/local.d/{{ item }}"
    with_items:
      - worker-normal.inc
      - worker-proxy.inc
      - logging.inc
    notify: reload rspamd.service

  - name: Rspamd prepare for no reject for a safe GOLIVE
    ansible.builtin.template:
      src: templates/basic_conf/override_d_actions.conf.j2
      dest: /etc/rspamd/override.d/actions.conf
    notify: reload rspamd.service

  - name: Copy classifier-bayes.conf
    ansible.builtin.template:
      src: templates/classifier-bayes.conf.j2
      dest: /etc/rspamd/local.d/classifier-bayes.conf
    notify: reload rspamd.service

  - name: Copy milter_headers.conf
    ansible.builtin.template:
      src: templates/milter_headers.conf.j2
      dest: /etc/rspamd/local.d/milter_headers.conf
    notify: reload rspamd.service

  #
  # Setup dkim
  #
  - name: Create directory for dkim
    ansible.builtin.file:
      path: /var/lib/rspamd/dkim/
      state: directory
      owner: _rspamd
      group: _rspamd
      mode: "0550"

  - name: Copy dkim key
    ansible.builtin.template:
      src: templates/mail.key.j2
      dest: /var/lib/rspamd/dkim/mail.key
    notify: reload rspamd.service

  - name: Copy dkim record
    ansible.builtin.template:
      src: templates/mail.txt.j2
      dest: /var/lib/rspamd/dkim/mail.txt

  - name: Chown dkim files
    ansible.builtin.file:
      path: /var/lib/rspamd/dkim/
      state: directory
      recurse: yes
      owner: _rspamd
      group: _rspamd
      mode: "0440"

  - name: Copy arc.conf and dkim_signing.conf
    ansible.builtin.template:
      src: templates/dkim_signing_and_arc.conf.j2
      dest: "/etc/rspamd/local.d/{{ item }}"
      owner: _rspamd
      group: _rspamd
      mode: "0440"
    with_items:
      - arc.conf
      - dkim_signing.conf
    notify: reload rspamd.service

  #
  # Setup redis
  #
  - name: Copy redis.conf
    ansible.builtin.template:
      src: templates/redis.conf.j2
      dest: /etc/rspamd/local.d/redis.conf
      owner: _rspamd
      group: _rspamd
      mode: "0440"
    notify: reload rspamd.service

  #
  # Setup rspamd spam learning
  #
  - name: Create directory for sieve filters
    ansible.builtin.file:
      path: /vol/mail/sieve/global/
      state: directory
    notify: reload rspamd.service

  - name: Copy sieve filters
    ansible.builtin.template:
      src: "templates/milter/{{ item }}.j2"
      dest: "/vol/mail/sieve/global/{{ item }}"
    with_items:
      - report-spam.sieve
      - report-ham.sieve
      - spam-global.sieve
    notify: reload rspamd.service

  - name: Compile sieve filters
    ansible.builtin.command:
      chdir: /vol/mail/sieve/global/
      cmd: sievec {{ item }}
    with_items:
      - report-spam.sieve
      - report-ham.sieve
      - spam-global.sieve
    notify: reload rspamd.service

  - name: Copy rspamd learning script
    become: true
    tags: rspamd
    ansible.builtin.template:
      src: "templates/milter/{{ item }}"
      dest: "/usr/bin/{{ item }}"
      mode: '0751'
    with_items:
      - sa-learn-ham.sh
      - sa-learn-spam.sh
    notify: reload rspamd.service

  - name: create local.d directory if it does not exists
    ansible.builtin.file:
      path: /etc/rpsamd/local.d
      state: directory

  - name: Copy multimap.conf
    ansible.builtin.template:
      src: templates/filters/multimap.conf
      dest: /etc/rspamd/local.d/multimap.conf
    notify: reload rspamd.service

  - name: copy filter files
    ansible.builtin.template:
      src: "templates/filters/{{ item }}.j2"
      dest: "/etc/rspamd/local.d/{{ item }}"
    with_items:
      - whitelist_sender_email.map
      - whitelist_sender_ip.map
      - whitelist_sender_domain.map
      - blacklist_reject_sender_email.map
      - blacklist_sender_ip.map
      - blacklist_reject_sender_domain.map
      - banned_extensions.map
    notify: reload rspamd.service
  # end block Install rspamd and relevant packages

  #
  # Install clamav and relevant packages
  #
- name: Install and configure clamav
  tags:
    - rspamd
    - clamav
  become: true

  block:

  - name: set selections for clamav-daemon TcpOrLocal
    ansible.builtin.debconf:
      name: clamav-daemon
      question: clamav-daemon/TcpOrLocal
      value: TCP
      vtype: select

  - name: set selections for clamav-daemon TCPAddr
    ansible.builtin.debconf:
      name: clamav-daemon
      question: clamav-daemon/TCPAddr
      value: localhost
      vtype: string

  - name: set selections for clamav-daemon TCPSocket
    ansible.builtin.debconf:
      name: clamav-daemon
      question: clamav-daemon/TCPSocket
      value: 3310
      vtype: string

  - name: set selections for clamav-daemon LocalSocket
    ansible.builtin.debconf:
      name: clamav-daemon
      question: clamav-daemon/LocalSocket
      value: ""
      vtype: string

  - name: install clamav
    ansible.builtin.apt:
      pkg:
        - clamav-daemon

  - name: configure system to provide tcp port
    ansible.builtin.replace:
      path: /lib/systemd/system/clamav-daemon.socket
      after: "[Socket]"
      regexp: "^ListenStream=/run/clamav/clamd.ctl"
      replace: "ListenStream=127.0.0.1:3310"

  - name: disable clamav-clamonacc.service
    ansible.builtin.service:
      name: clamav-clamonacc
      enabled: false

  - name: add rspamd to clamav group
    ansible.builtin.user:
      name: _rspamd
      groups: clamav
      append: true

  - name: clamav systemctl daemon-reload
    ansible.builtin.systemd:
      daemon_reload: true

  - name: Copy antivirus.conf
    ansible.builtin.template:
      src: templates/antivirus.conf.j2
      dest: /etc/rspamd/local.d/antivirus.conf
    notify: reload clamav-daemon.service

  # freshclam is scheduled by cronjob
  # /etc/cron.d/perfact-custom:41 21 * * * root    /usr/bin/freshclam --quiet
  - name: clamav deactivte freshclam.service
    ansible.builtin.service:
      name: clamav-freshclam
      enabled: false

  - name: Reminder to start clamav
    ansible.builtin.debug:
      msg: "Start clamav-daemon manually: systemctl start clamav-daemon.service"
