---
# Copyright 2024, Cleura AB
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: Create the system group
  ansible.builtin.group:
    name: "{{ httpd_service_group_name }}"
    state: "present"
    system: "yes"

- name: Create the system user
  ansible.builtin.user:
    name: "{{ httpd_service_user_name }}"
    group: "{{ httpd_service_group_name }}"
    comment: "Apache Web Server user"
    shell: "/usr/bin/false"
    system: "yes"
    createhome: "yes"
    home: "{{ httpd_service_home_folder }}"

- name: Default and vhosts root directory setup
  vars:
    _vhost_document_roots: >-
      {{
        (
          httpd_vhosts | selectattr('state', 'defined') | selectattr('state', 'eq', 'present') +
          httpd_vhosts | selectattr('state', 'undefined')
        ) | selectattr('document_root', 'defined') | map(attribute='document_root') | map('community.general.dict_kv', 'path')
      }}
    _default_paths:
      - path: "{{ httpd_conf_dir }}/sites-available"
        mode: "0750"
      - path: "{{ httpd_service_home_folder }}"
        mode: "0750"
        condition: "{{ ansible_facts['os_family'] | lower == 'debian' }}"
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: "{{ item.state | default('directory') }}"
    owner: "{{ httpd_service_user_name }}"
    group: "{{ httpd_service_group_name }}"
    mode: "{{ item.mode | default('0755') }}"
  with_items: "{{ _default_paths + _vhost_document_roots }}"
  when:
    - item.condition | default(true)

- name: Create SSL CA for self-generated certificates
  ansible.builtin.include_role:
    name: pki
    tasks_from: main_ca.yml
    apply:
      tags:
        - httpd-install
        - pki
  vars:
    pki_setup_host: "{{ httpd_pki_setup_host }}"
    pki_dir: "{{ httpd_pki_dir }}"
    pki_create_ca: "{{ httpd_pki_create_ca }}"
    pki_authorities: "{{ httpd_pki_authorities }}"
    pki_regen_ca: "{{ httpd_pki_regen_ca }}"
  when:
    - httpd_pki_create_ca | bool
    - httpd_pki_authorities | length > 0
  tags:
    - httpd-install
    - pki

- name: Install SSL CA for self-generated certificates
  ansible.builtin.include_role:
    name: pki
    tasks_from: main_ca_install.yml
    apply:
      tags:
        - httpd-install
        - pki
  vars:
    pki_setup_host: "{{ httpd_pki_setup_host }}"
    pki_dir: "{{ httpd_pki_dir }}"
    pki_install_ca: "{{ httpd_pki_install_ca }}"
  when:
    - httpd_pki_create_ca | bool
    - httpd_pki_install_ca | length > 0
  tags:
    - httpd-install
    - pki