- name: "Install arachne"
  hosts: all
  become: true

  vars:
    http_keytab: /etc/httpd/krb5.keytab
    arachne_cfg_dir: /var/lib/arachne/arachneconfig

    cert_file: "/etc/pki/tls/certs/{{ ansible_fqdn }}_arachne.crt"
    key_file: "/etc/pki/tls/private/{{ ansible_fqdn }}_arachne.key"

  tasks:
  - name: "Enable arachne repository {{ archne_repo | default('n/a') }}"
    yum_repository:
      name: "Arachne"
      baseurl: "{{ arachne_repo is defined and arachne_repo == '' }}"
    when: arachne_repo

  - name: "Enable arachne copr repo"
    community.general.copr:
      name: "{{ arachne_copr | default('@nieslony/arachne') }}"
      chroot: rhel+epel-10-x86_64
    when: arachne_repo is not defined or arachne_repo == ''

  - name: "Enable EPEL"
    dnf:
      name: epel-release

  - name: "Install Updates"
    dnf:
      name: "*"
      state: latest

  - name: "Force installation of python3-inotify_simple from EPEL 10.2"
    dnf:
      name: "https://kojipkgs.fedoraproject.org//packages/python-inotify_simple/1.3.5/16.el10_2/noarch/python3-inotify_simple-1.3.5-16.el10_2.noarch.rpm"
      disable_gpg_check: true
    when:
      - ansible_facts.distribution_file_variety == "RedHat"
      - ansible_facts.distribution_version == "10.1"

  - name: "Install arachne"
    dnf:
      name:
        - arachne
        - firewalld
      state: latest
    notify: reboot

  - name: "Symlink arachne.conf"
    file:
      src: /var/lib/arachne/arachneconfig/arachne.conf
      dest: "/etc/httpd/conf.d/{{ ansible_fqdn }}.conf.inc"
      state: link
      force: yes
      follow: no

  - name: "Create DH params"
    community.crypto.openssl_dhparam:
      path: /var/lib/arachne/vpnconfig/dh.pem
      size: 2048

  - name: "Set seboolean"
    seboolean:
      name: "{{ item }}"
      state: true
      persistent: true
    with_items:
      - httpd_can_network_connect
      - httpd_can_network_connect

  - name: "Find {{ http_keytab }}"
    stat:
      path: "{{ http_keytab }}"
    register: stat_krb5_keytab

  - name: "Copy {{ http_keytab }} to {{ arachne_cfg_dir }}"
    copy:
      src: "{{ http_keytab }}"
      dest: "{{ arachne_cfg_dir }}"
      remote_src: true
      owner: arachne
      group: arachne
    when: stat_krb5_keytab.stat.exists

  - name: "Find /etc/ipa/ca.crt"
    stat:
      path: /etc/ipa/ca.crt
    register: stat_ipa_ca_crt

  - block:
    - name: "Get certificate"
      command:
        cmd: >
          ipa-getcert request
            --certfile=/etc/pki/tls/certs/{{ ansible_fqdn }}_arachne.crt
            --keyfile=/etc/pki/tls/private/{{ ansible_fqdn }}_arachne.key
            --key-owner=arachne
            --cert-owner=arachne
            --wait
        creates: "/etc/pki/tls/private/{{ ansible_fqdn }}_arachne.key"
      environment:
        KRB5_CLIENT_KTNAME: /etc/krb5.keytab
        KRB5CCNAME: "KEYRING:session:%{uid}"
        https_proxy: ""
        http_proxy: ""

    - name: "Symlink certitficate and key to {{ arachne_cfg_dir }}"
      file:
        dest: "{{ arachne_cfg_dir }}/{{ item.key }}"
        src: "{{ item.value }}"
        state: link
      with_dict:
        server.crt: "{{ cert_file }}"
        server.key: "{{ key_file }}"
    when: stat_ipa_ca_crt.stat.exists

  - name: "Start services"
    service:
      name: "{{ item }}"
      enabled: yes
      state: started
    with_items:
      - arachne
      - arachne-dbus
      - firewalld

  - name: "Open ports in firewall"
    firewalld:
      port: "{{ (item is integer) | ternary(item | string + '/tcp', omit) }}"
      service: "{{ (item is string) | ternary(item, omit) }}"
      permanent: yes
      state: enabled
      immediate: yes
    with_items:
      - 8080
      - 8443

  - name: "Allow openVPN from everywhere"
    firewalld:
      rich_rule: "rule family=ipv4 port protocol={{ item }} port=1194 accept"
      permanent: yes
      state: enabled
      immediate: yes
    with_items:
      - tcp
      - udp

  handlers:
  - name: "Reboot"
    reboot:
    listen: reboot
