---
# roles/phonehome_deploy

# installation of perfact-phonehome-2020-prod
#
# additionally the ssh-keys for pfremote (phonehome-systems)
# have to be deployed.

- name: Use role in loop
  tags:
    - ssh_hostkeys
    - set_hostname
    - sshd_config
    - pffirewall
    - pyroutinecheck
    - pfbackup
    - perfact-measure
  include_role:
    name: "{{ role_phonehome_file }}"
  loop:
    - 'general/ssh_host_keys'
    - 'base_install'
    - 'general/pffirewall'
    - 'general/pfpyroutinecheck'
    - 'general/pfbackup'
    - 'general/sshd_config'
    # the role perfact-monit tryes to create a link from /etc/monit/conf-available/measure to /etc/monit/conf-enabled/
    # so perfact-measure must be installed before perfact-monit
    - 'perfact-measure'
  loop_control:
    loop_var: role_phonehome_file
#  args:
#    apply:
#      become: true
# perfact-measure must not be started with become, because it works on localhost
# fatal: [pf-phonehome-2020-prod -> localhost]: FAILED! => {"changed": false, "module_stderr": "sudo: Ein Passwort ist notwendig\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

- name: add role monit
  tags: monit
  include_role:
    name: general/perfact-monit

- name: add role fail2ban
  tags: fail2ban
  ansible.builtin.include_role:
    name: general/fail2ban

- name: reserve ports
  # specific to pf-phonehome: reseve ports for phonehome
  become: true
  ansible.builtin.copy:
    content: "net.ipv4.ip_local_reserved_ports = 10000-20000"
    dest: "/etc/sysctl.d/96-perfact-phonehome.conf"
  notify: reload sysctl

- name: install postfix
  become: true
  ansible.builtin.package:
    name: postfix
    state: present

- name: configure postfix
  become: true
  ansible.builtin.template:
    src: etc/postfix/main.cf.j2
    dest: /etc/postfix/main.cf
  notify: reload postfix.service

# This is a dependecy from pypyroutinecheck
- name: create mailname file
  become: true
  ansible.builtin.copy:
    content: "{{ postfix_smtp_mailname }}"
    dest: /etc/mailname

# creation of user pfremote and all authorized_keys
- include_tasks: pfremote.yml

- name: create users for perfact-employes
  include_role:
    name: phonehome-server-perfact-users
  #args:
  #  apply:
  #    become: true
  # this calls load_users which must not be run with become.
  # files get wirtten on local drive, which will fail:
  # <localhost> EXEC /bin/sh -c 'rm -f -r /home/skalinowski/.ansible/tmp/ansible-tmp-1641770743.2658854-106264264078643/ > /dev/null 2>&1 && sleep 0'
  #fatal: [pf-phonehome-2020-prod -> localhost]: FAILED! => {
  #    "changed": false,
  #    "module_stderr": "sudo: Ein Passwort ist notwendig\n",
  #    "module_stdout": "",
  #    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
  #    "rc": 1
  #}

# include role  perfact-phonehome-checker T225852
- name: include role perfact-phonehome-checker
  tags: perfact-phonehome-checker
  include_role:
    name: perfact-phonehome-checker

# commit changes made by ansible
- name: git commit
  become: true
  ansible.builtin.shell: git diff --quiet || { git add --all && git commit -m "Changes by ansible" ; }
  args:
    chdir: /etc/
