---

# Main implementation
# ===================

- name: Set-up the Debian backports repository
  ansible.builtin.template:
    src: backports.list.j2
    dest: /etc/apt/sources.list.d/backports.list
    owner: root
    group: root
    mode: "0644"
  register: backports_repository_configuration

- name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa no-handler
  # [no-handler] Tasks that run when changed should likely be handlers
  #   Since apt_repository module is not reliable (does not deploy
  #   change when changing distro version etc), we have to use
  #   template instead, but this also means we need to trigger the apt
  #   cache reload by hand.
  ansible.builtin.apt:
    update_cache: true
  when: backports_repository_configuration.changed

- name: Install additional Prosody dependencies
  ansible.builtin.apt:
    name:
      - lua-ldap
      - prosody-modules
    state: present
  notify:
    - Restart Prosody

- name: Install Prosody
  ansible.builtin.apt:
    name: prosody
    state: present
  notify:
    - Restart Prosody

- name: Allow Prosody user to traverse the directory with TLS private keys
  ansible.builtin.user:
    name: prosody
    append: true
    groups: ssl-cert

- name: Deploy XMPP TLS private key
  ansible.builtin.copy:
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key"
    content: "{{ xmpp_tls_key }}"
    owner: root
    group: prosody
    mode: "0640"
  notify:
    - Restart Prosody

- name: Deploy XMPP TLS certificate
  ansible.builtin.copy:
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
    content: "{{ xmpp_tls_certificate }}"
    owner: root
    group: root
    mode: "0644"
  notify:
    - Restart Prosody

- name: Generate the XMPP server Diffie-Hellman parameter
  community.crypto.openssl_dhparam:
    owner: root
    group: prosody
    mode: "0640"
    path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"
    size: 2048
  notify:
    - Restart Prosody

- name: Deploy configuration file for checking certificate validity via cron
  ansible.builtin.copy:
    content: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
    dest: "/etc/check_certificate/{{ ansible_fqdn }}_xmpp.conf"
    owner: root
    group: root
    mode: "0644"

- name: Deploy script for validating Prosody certificate
  ansible.builtin.copy:
    src: "check_prosody_certificate.sh"
    dest: "/usr/local/bin/check_prosody_certificate.sh"
    owner: root
    group: root
    mode: "0755"

- name: Set-up crontab task that runs the Prosody certificate checker script once a day
  ansible.builtin.copy:
    src: "cron_check_prosody_certificate"
    dest: "/etc/cron.d/check_prosody_certificate"
    owner: root
    group: root
    mode: "0644"

- name: Deploy LDAP client configuration (for validating LDAP server certificate)
  ansible.builtin.copy:
    src: prosody_ldaprc
    dest: "/var/lib/prosody/.ldaprc"
    owner: root
    group: prosody
    mode: "0640"
  notify:
    - Restart Prosody

- name: Deploy Prosody configuration file
  ansible.builtin.template:
    src: "prosody.cfg.lua.j2"
    dest: "/etc/prosody/prosody.cfg.lua"
    owner: root
    group: prosody
    mode: "0640"
  notify:
    - Restart Prosody

- name: Enable and start Prosody service
  ansible.builtin.service:
    name: prosody
    state: started
    enabled: true

- name: Deploy firewall configuration for XMPP server
  ansible.builtin.copy:
    src: "ferm_xmpp.conf"
    dest: "/etc/ferm/conf.d/30-xmpp.conf"
    owner: root
    group: root
    mode: "0640"
  notify:
    - Restart ferm

- name: Explicitly run all handlers
  ansible.builtin.include_tasks: ../handlers/main.yml
  when: "run_handlers | default(False) | bool()"
  tags:
    - handlers