---

# @TODO: Can't use file module, since one of the files (GnuPG socket)

#        seems to disappear in middle of operation).

- name: Remove current keyring  # noqa no-changed-when

  # [no-changed-when] Commands should not change things if nothing needs doing

  #   This task is invoked only if user is very specific about requiring to

  #   run the handlers manually as a way to bring the system to consistency

  #   after interrupted runs.

  command: "rm -rf /etc/duply/main/gnupg"

- name: Create keyring directory

  file:

    path: "/etc/duply/main/gnupg"

    state: directory

    owner: root

    group: root

    mode: 0700

- name: Import private keys  # noqa no-changed-when

  # [no-changed-when] Commands should not change things if nothing needs doing

  #   This task is invoked only if user is very specific about requiring to

  #   run the handlers manually as a way to bring the system to consistency

  #   after interrupted runs.

  command: "gpg --no-tty --homedir /etc/duply/main/gnupg --import /etc/duply/main/private_keys.asc"

  command: "gpg --no-tty --homedir /etc/duply/main/gnupg --import /etc/duply/main/public_keys.asc"

  when: backup_additional_encryption_keys | length > 0

        state: link

- name: Prepare

  hosts: all

  become: true

  gather_facts: false

  tasks:

    - name: Install python for Ansible

      raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

      apt:

        update_cache: true

      changed_when: false

    - name: Install net-tools for running Testinfra host.socket tests

      apt:

        name: net-tools

        state: present

    - name: Remove the ss utility (see https://github.com/philpep/testinfra/pull/320)

      file:

        path: "/bin/ss"

        state: absent

- name: Prepare, helpers

  hosts: helper

  become: true

  tasks:

    - name: Install apt-cacher-ng

      apt:

        name: apt-cacher-ng

        state: present

- name: Prepare, helpers

  hosts: client

  become: true

  tasks:

    - name: Install tool for testing TCP connectivity

      apt:

        name: nmap

        state: present

    - name: Set-up /etc/hosts with entries for all servers

      lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: 0644

        state: present

      with_dict:

        192.168.56.21: parameters-mandatory-bookworm

        192.168.56.22: parameters-optional-bookworm

        fd00::192:168:56:21: parameters-mandatory-bookworm

        fd00::192:168:56:22: parameters-optional-bookworm

- name: Prepare, test fixtures

  hosts: parameters-mandatory,parameters-optional

  become: true

  tasks:

    - name: Set-up /etc/hosts with entries for all servers

      lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: 0644

        state: present

      with_dict:

        192.168.56.3: client1

        192.168.56.4: client2

    - name: Load legacy iptables to test their removal

      modprobe:

        name: "{{ item }}"

        state: present

      with_items:

        - iptable_filter

        - iptable_nat

        - iptable_mangle

        - iptable_security

        - iptable_raw

        - ip6table_filter

        - ip6table_nat

        - ip6table_mangle

        - ip6table_security

        - ip6table_raw

      command: "iptables-legacy -t '{{ item }}' -N '{{ (ansible_date_time.iso8601_micro | to_uuid)[:28] }}'"

      with_items:

        - filter

        - nat

        - mangle

        - security

        - raw

      command: "ip6tables-legacy -t '{{ item }}' -N '{{ (ansible_date_time.iso8601_micro | to_uuid)[:28] }}'"

      with_items:

        - filter

        - nat

        - mangle

        - security

        - raw

    - name: Create deprecated directory for storing requirements files created using Python 3 (pip requirements upgrade checks)

      file:

        path: "/etc/pip_check_requirements_upgrades-py3"

        state: directory

        owner: root

        group: root

        mode: 0750

    - name: Create deprecated directory for Python 3 virtual environment (pip requirements upgrade checks)

      file:

        path: "/var/lib/pipreqcheck/virtualenv-py3/"

        state: directory

        owner: root

        group: root

        mode: 0750

    - name: Create deprecated cronjob file for Python 3 (pip requirements upgrade checks)

      file:

        path: "/etc/cron.d/check_pip_requirements-py3"

        state: touch

        owner: root

        group: root

        mode: 0644

    - name: Install the deprecated/obsolete NTP-related packages

      apt:

        name:

          - ntp

          - ntpdate

        state: present

---

# Deprecation

# ===========

- name: Drop deprecated directories and files

  file:

    path: "{{ item }}"

    state: absent

  with_items:

    - "/etc/pip_check_requirements_upgrades-py3"

    - "/var/lib/pipreqcheck/virtualenv-py3"

    - "/etc/cron.d/check_pip_requirements-py3"

- name: Drop deprecated packages

  apt:

    name:

      - ntp

      - ntpdate

    state: absent

    purge: true

# Main implementation

# ===================

- name: Enable use of proxy for retrieving system packages via apt

  template:

    src: "apt_proxy.j2"

    dest: "/etc/apt/apt.conf.d/00proxy"

    owner: root

    group: root

    mode: 0644

  when: apt_proxy is defined

- name: Disable use of proxy for retrieving system packages via apt

  file:

    path: "/etc/apt/apt.conf.d/00proxy"

    state: absent

  when: apt_proxy is undefined

- name: Deploy pam-auth-update configuration file for enabling pam_umask

  copy:

    src: "pam_umask"

    dest: "/usr/share/pam-configs/umask"

    owner: root

    group: root

    mode: 0644

  register: pam_umask

  notify:

    - Update PAM configuration

- name: Update PAM configuration  # noqa no-handler

  # [no-handler] Tasks that run when changed should likely be handlers

  #   In order to have consistent behaviour during the first and

  #   subsequent playbook runs, make sure the PAM configuration is

  #   updated immediatelly. This way any files created by commands etc

  #   should end-up with correct permissions straight away.

  command: "/usr/sbin/pam-auth-update --package"

  when: pam_umask.changed

- name: Set login UMASK

  lineinfile:

    dest: "/etc/login.defs"

    state: present

    backrefs: true

    regexp: '^UMASK(\s+)'

    line: 'UMASK\g<1>027'

- name: Set home directory mask

  lineinfile:

    dest: "/etc/adduser.conf"

    state: present

    backrefs: true

    regexp: '^\s*#?\s*DIR_MODE='

    line: 'DIR_MODE=0750'

- name: Deploy bash profile configuration for fancier prompts

  template:

    src: "bash_prompt.sh.j2"

    dest: "/etc/profile.d/bash_prompt.sh"

    owner: root

    group: root

    mode: 0644

- name: Deploy profile configuration that allows for user-specific profile.d files

  copy:

    src: "user_profile_d.sh"

    dest: "/etc/profile.d/z99-user_profile_d.sh"

    owner: root

    group: root

    mode: 0644

- name: Replace default and skeleton bashrc

  copy:

    src: "{{ item.key }}"

    dest: "{{ item.value }}"

    owner: root

    group: root

    mode: 0644

  with_dict:

    bashrc: "/etc/bash.bashrc"

    skel_bashrc: "/etc/skel/.bashrc"

- name: Calculate stock checksum for bashrc root account

  stat:

    path: "/root/.bashrc"

  register: root_bashrc_stat

- name: Replace stock bashrc for root account with skeleton one

  copy:

    src: "skel_bashrc"

    dest: "/root/.bashrc"

    owner: root

    group: root

    mode: 0640

  # Checksums: bookworm

  when: |

    root_bashrc_stat.stat.checksum == "1a422a148ad225aa5ba33f8dafd2b7cfcdbd701f"

- name: Install sudo

  apt:

    name: sudo

    state: present

- name: Install ssl-cert package

  apt:

    name: ssl-cert

    state: present

- name: Install common packages

  apt:

    name: "{{ common_packages }}"

    state: "present"

- name: Disable electric-indent-mode for Emacs by default for all users

  copy:

    src: "01disable-electric-indent-mode.el"

    dest: "/etc/emacs/site-start.d/01disable-electric-indent-mode.el"

    owner: root

    group: root

    mode: 0644

  when: "['emacs24', 'emacs24-nox', 'emacs25', 'emacs25-nox', 'emacs', 'emacs-nox'] | intersect(common_packages) | length > 0"

- name: Set-up operating system groups

  group:

    name: "{{ item.name }}"

    gid: "{{ item.gid | default(omit) }}"

    state: present

  with_items: "{{ os_groups }}"

- name: Set-up operating system user groups

  group:

    name: "{{ item.name }}"

    gid: "{{ item.uid | default(omit) }}"

    state: present

  with_items: "{{ os_users }}"

- name: Set-up operating system users

  user:

    name: "{{ item.name }}"

    uid: "{{ item.uid | default(omit) }}"

    group: "{{ item.name }}"

    groups: "{{ ','.join(item.additional_groups | default([])) }}"

    append: true

    shell: /bin/bash

    state: present

    password: "{{ item.password | default('!') }}"

    update_password: on_create

  with_items: "{{ os_users }}"

- name: Set-up authorised keys

  authorized_key:

    user: "{{ item.0.name }}"

    key: "{{ item.1 }}"

  with_subelements:

    - "{{ os_users | selectattr('authorized_keys', 'defined') | list }}"

    - authorized_keys

- name: Disable remote logins for root

  lineinfile:

    dest: "/etc/ssh/sshd_config"

    state: present

    regexp: "^PermitRootLogin"

    line: "PermitRootLogin no"

  notify:

    - Restart SSH

- name: Disable remote login authentication via password

  lineinfile:

    dest: "/etc/ssh/sshd_config"

    state: present

    regexp: "^PasswordAuthentication"

    line: "PasswordAuthentication no"

  notify:

    - Restart SSH

- name: Deploy CA certificates

  copy:

    content: "{{ item.value }}"

    dest: "/usr/local/share/ca-certificates/{{ item.key }}.crt"

    owner: root

    group: root

    mode: 0644

  with_dict: "{{ ca_certificates }}"

  register: deploy_ca_certificates_result

- name: Update CA certificate cache  # noqa no-handler

  # [no-handler] Tasks that run when changed should likely be handlers

  #   CA certificate cache must be updated immediatelly in order for

  #   applications depending on deployed CA certificates can use them to

  #   validate server/client certificates.

  command: "/usr/sbin/update-ca-certificates --fresh"

  when: deploy_ca_certificates_result.changed

- name: Set-up file diversions for custom files that overrride package-provided ones

  command: "dpkg-divert --divert '{{ item }}.original' --rename '{{ item }}'"

  register: "dpkg_divert"

  changed_when: "'Adding' in dpkg_divert.stdout"

  with_items:

    - "/usr/sbin/ferm"

  notify:

    - Restart ferm

- name: Deploy the patched ferm binary that disables use of legacy iptables

  copy:

    src: ferm_binary

    dest: /usr/sbin/ferm

    owner: root

    group: root

    mode: 0755

  notify:

    - Restart ferm

- name: Install ferm (for firewall management)

  apt:

    name: ferm

    state: present

- name: Configure ferm init script coniguration file

  copy:

    src: "ferm_default"

    dest: "/etc/default/ferm"

    owner: root

    group: root

    mode: 0644

  notify:

    - Restart ferm

- name: Create directory for storing ferm configuration files

  file:

    dest: "/etc/ferm/conf.d/"

    state: directory

    owner: root

    group: root

    mode: 0750

- name: Deploy main ferm configuration file

  copy:

    src: "ferm.conf"

    dest: "/etc/ferm/ferm.conf"

    owner: root

    group: root

    mode: 0640

  notify:

    - Restart ferm

- name: Verify maintenance_allowed_sources parameter

  fail:

    msg: "Items in maintenance_allowed_sources must IPv4/IPv6 addresses or subnets: {{ item }}"

  when: "not (item is ansible.utils.ipv4_address or item is ansible.utils.ipv6_address)"

  with_items: "{{ maintenance_allowed_sources }}"

- name: Deploy ferm base rules

  template:

    src: "00-base.conf.j2"

    dest: "/etc/ferm/conf.d/00-base.conf"

    owner: root

    group: root

    mode: 0640

  notify:

    - Restart ferm

- name: Enable and start ferm

  service:

    name: ferm

    state: started

    enabled: true

- name: Deploy script for flushing legacy iptables rules

  copy:

    src: "legacy_iptables_rules.sh"

    dest: "/usr/local/sbin/drop_legacy_iptables_rules.sh"

    owner: root

    group: root

    mode: 0755

- name: Drop legacy iptables rules

  command: "/usr/local/sbin/drop_legacy_iptables_rules.sh remove"

  register: legacy_iptables_rules

  changed_when: "'Removed legacy iptables for families' in legacy_iptables_rules.stdout"

  notify:

    - Restart ferm

- name: Deploy script for validating server certificates

  copy:

    src: "check_certificate.sh"

    dest: "/usr/local/bin/check_certificate.sh"

    owner: root

    group: root

---

- name: Set domain for slapd

  debconf:

    name: slapd

    question: slapd/domain

    vtype: string

    value: "{{ ldap_server_domain }}"

- name: Set organisation for slapd

  debconf:

    name: slapd

    question: shared/organization

    vtype: string

    value: "{{ ldap_server_organization }}"

- name: Install slapd

  apt:

    name: slapd

    state: present

- name: Allow OpenLDAP user to traverse the directory with TLS private keys

  user:

    name: openldap

    append: true

    groups: ssl-cert

  register: openldap_in_ssl_cert

- name: Restart slapd if group membership has changed (apply immediatelly)  # noqa no-handler

  # [no-handler] Tasks that run when changed should likely be handlers

  #   In order to be able to change LDAP server TLS configuration, it must be

  #   able to read both the private key and certificate. Therefore we need to

  #   immediatelly restart (since configuration is done live on the server.

  service:

    name: slapd

    state: restarted

  when: openldap_in_ssl_cert.changed

- name: Install Python LDAP bindings

  apt:

    name: python3-pyldap

    state: present

- name: Set-up LDAP server to listen on legacy SSL port

  lineinfile:

    dest: /etc/default/slapd

    state: present

    backrefs: true

    regexp: '^SLAPD_SERVICES=.*'

    line: 'SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"'

  notify:

    - Restart slapd

- name: Enable and start slapd service

  service:

    name: slapd

    state: started

    enabled: true

- name: Change log level for slapd

  ldap_attr:

    dn: cn=config

    state: exact

    name: olcLogLevel

    values: "{{ ldap_server_log_level }}"

- name: Test if LDAP misc schema has been applied

  command: "ldapsearch -H ldapi:/// -Q -LLL -A -Y EXTERNAL -b cn=schema,cn=config -s one '(cn={*}misc)' cn"

  register: ldap_misc_schema_present

  changed_when: false

- name: Deploy LDAP misc schema

  command: "ldapadd -H ldapi:/// -Q -Y EXTERNAL -f /etc/ldap/schema/misc.ldif"

  when: not ldap_misc_schema_present.stdout

# Technically, the only thing this does is pick the size of DH

# parameters to use, with GnuTLS (against which slapd is linked

# against under Debian) picking a matching DH parameter from RFC-7919

# (https://www.ietf.org/rfc/rfc7919.txt).

- name: Generate the LDAP server Diffie-Hellman parameter

  openssl_dhparam:

    owner: root

    group: openldap

    mode: 0640

    path: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.dh.pem"

    size: 2048

  notify:

    - Restart slapd

- name: Deploy LDAP TLS private key

  template:

    src: "ldap_tls_key.j2"

    dest: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.key"

    mode: 0640

    owner: root

    group: openldap

  notify:

    - Restart slapd

- name: Deploy LDAP TLS certificate

  template:

    src: "ldap_tls_cert.j2"

    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem"

    mode: 0644

    owner: root

    group: root

  notify:

    - Restart slapd

- name: Deploy configuration file for checking certificate validity via cron

  copy:

    content: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem"

    dest: "/etc/check_certificate/{{ ansible_fqdn }}_ldap.conf"

    owner: root

    group: root

    mode: 0644

# We need to have this hack around TLS configuration because OpenLDAP

# expects both private key and certificate to be set at the same

# time.

#

# OpenLDAP server behaviour is a bit weird around this thing, so here

# is what happens:

#

# 1. First we set the private key, but ignore all errors. This has not

#    yet changed the private key path, though.

#

# 2. Then we set the certificate. This succeeds, but the private key

#    path still has the old value. If we haven't done the step (1),

#    this task would fail too.

#

# 3. Now we can finally change the private key too, and LDAP server

#    will be able to validate it against the corresponding certificate.

#

# See https://github.com/ansible/ansible/issues/25665 for more

# information.

- name: Configure TLS private key (ignore errors)

  ldap_attr:

    dn: cn=config

    name: olcTLSCertificateKeyFile

    values: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.key"

    state: exact

  failed_when: false

- name: Configure TLS certificate

  ldap_attr:

    dn: cn=config

    name: olcTLSCertificateFile

    values: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem"

    state: exact

- name: Configure TLS private key

  ldap_attr:

    dn: cn=config

    name: olcTLSCertificateKeyFile

    values: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.key"

    state: exact

- name: Configure DH parameter

  ldap_attr:

    dn: cn=config

    name: olcTLSDHParamFile

    values: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.dh.pem"

    state: exact

- name: Configure TLS cipher suites

  ldap_attr:

    dn: cn=config

    name: olcTLSCipherSuite

    values: "{{ ldap_tls_ciphers }}"

- name: Prepare, test fixtures

  hosts: localhost

  connection: local

  gather_facts: false

  tasks:

    - name: Initialise CA hierarchy

      command: "gimmecert init"

      args:

        creates: ".gimmecert/ca/level1.cert.pem"

        chdir: "tests/data/"

    - name: Generate server private keys and certificates

      command:

      args:

        chdir: "tests/data/"

        creates: ".gimmecert/server/{{ item.name }}.cert.pem"

        argv:

          - "gimmecert"

          - "server"

          - "{{ item.name }}"

          - "{{ item.fqdn }}"

      with_items:

        - name: mail-server_smtp

          fqdn: mail-server

    - name: Set-up link to generated X.509 material

      file:

        src: ".gimmecert"

        dest: "tests/data/x509"

        state: link

- name: Prepare

  hosts: all

  become: true

  gather_facts: false

  tasks:

    - name: Install python for Ansible

      raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

      apt:

        update_cache: true

      changed_when: false

    - name: Set-up the hosts file

      lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: 0644

        state: present

      with_dict:

        192.168.56.11: "mail-server domain1"

        192.168.56.12: "client1"

        192.168.56.21: "parameters-mandatory-bookworm"

        192.168.56.22: "parameters-optional-bookworm"

        192.168.56.23: "parameters-no-incoming-bookworm"

    - name: Install tools for testing

      apt:

        name: gnutls-bin

        state: present

- name: Prepare, helpers

  hosts: clients

  become: true

  tasks:

    - name: Install SWAKS for testing SMTP capability

      apt:

        name: swaks

        state: present

    - name: Install tool for testing TCP connectivity

      apt:

        name: hping3

        state: present

    - name: Deploy CA certificate

      copy:

        src: tests/data/x509/ca/level1.cert.pem

        dest: /usr/local/share/ca-certificates/testca.crt

        owner: root

        group: root

        mode: 0644

      notify:

        - Update CA certificate cache

  handlers:

      command: /usr/sbin/update-ca-certificates --fresh

- name: Prepare, helpers

  hosts: mail-servers

  become: true

  tasks:

    - name: Deploy CA certificate

      copy:

        src: tests/data/x509/ca/level1.cert.pem

        dest: /usr/local/share/ca-certificates/testca.crt

        owner: root

        group: root

        mode: 0644

      notify:

        - Update CA certificate cache

    - name: Deploy SMTP private key and certificate

      copy:

        src: "tests/data/x509/server/{{ item }}"

        dest: "/etc/ssl/{{ item }}"

        owner: root

        group: root

        mode: 0600

      with_items:

        - mail-server_smtp.cert.pem

        - mail-server_smtp.key.pem

    - name: Install Postfix

      apt:

        name: "postfix"

        state: present

    - name: Purge Exim configuration

      apt:

        name: "exim4*"

        state: absent

        purge: true

    - name: Deploy Postfix configuration

      copy:

        src: tests/data/main.cf

        dest: /etc/postfix/main.cf

        owner: root

        group: root

        mode: 0644

      notify:

        - Restart Postfix

    - name: Install tool for testing TCP connectivity

      apt:

        name: hping3

        state: present

    - name: Install SWAKS for testing SMTP capability

      apt:

        name: swaks

        state: present

    - name: Set-up port forwarding

      command: "iptables -t nat -A PREROUTING -p tcp -m tcp --dport 27 -j REDIRECT --to-ports 25"

      changed_when: false

  handlers:

      command: /usr/sbin/update-ca-certificates --fresh

    - name: Restart Postfix

      service:

        name: postfix

        state: restarted

- name: Prepare, test fixtures

  hosts: parameters-optional

  become: true

  tasks:

    - name: Create additional group for testing local aliases

      group:

        name: testuser

    - name: Create additional user for testing local aliases

      user:

        name: testuser

        group: testuser