---

- hosts: all
  tasks:

    - name: Update all caches to avoid errors due to missing remote archives
      apt:
        update_cache: yes
      changed_when: False

- hosts: all
  tasks:

    - name: Set-up /etc/hosts entries
      lineinfile:
        dest: /etc/hosts
        line: "{{ item.key }} {{ item.value }}"
      with_dict:
        10.31.127.10: "ldap-server backup-server"
        10.31.127.20: "client1"
        10.31.127.21: "client2"
        10.31.127.30: "parameters-mandatory"
        10.31.127.31: "parameters-optional"

- hosts: client1,client2
  tasks:

    - name: Install SWAKS for testing SMTP capability
      apt:
        name: swaks
        state: installed

    - name: Install pip
      apt:
        name: python-pip
        state: installed

    - name: Install IMAP CLI tool
      pip:
        name: Imap-CLI==0.6
        state: present

    - name: Install tool for testing SIEVE
      apt:
        name: sieve-connect
        state: installed

    - name: Install tool for testing TCP connectivity
      apt:
        name: hping3
        state: installed

    - name: Deploy IMAP CLI configuration
      copy:
        src: "tests/data/{{ item }}"
        dest: "/home/vagrant/{{ item }}"
        owner: vagrant
        group: vagrant
        mode: 0600
      with_items:
        - imapcli-parameters-mandatory-john_doe.conf
        - imapcli-parameters-mandatory-jane_doe.conf
        - imapcli-parameters-optional-john_doe.conf
        - imapcli-parameters-optional-jane_doe.conf

    - name: Deploy CA certificate
      copy:
        src: tests/data/x509/ca.cert.pem
        dest: /usr/local/share/ca-certificates/testca.crt
        owner: root
        group: root
        mode: 0644
      notify:
        - Update CA certificate cache

  handlers:

    - name: Update CA certificate cache
      command: /usr/sbin/update-ca-certificates --fresh

- hosts: ldap-server
  roles:
    - role: ldap_server
      ldap_admin_password: admin
      ldap_entries:

        # Users
        - dn: uid=john,ou=people,dc=local
          attributes:
            objectClass:
              - inetOrgPerson
              - simpleSecurityObject
            userPassword: johnpassword
            uid: john
            cn: John Doe
            sn: Doe
            mail: john.doe@domain1
        - dn: uid=jane,ou=people,dc=local
          attributes:
            objectClass:
              - inetOrgPerson
              - simpleSecurityObject
            userPassword: janepassword
            uid: jane
            cn: Jane Doe
            sn: Doe
            mail: jane.doe@domain2

        - dn: uid=nomail,ou=people,dc=local
          attributes:
            objectClass:
              - inetOrgPerson
              - simpleSecurityObject
            userPassword: nomailpassword
            uid: nomail
            cn: No Mail
            sn: Mail
            mail: nomail@domain1

        # Groups
        - dn: "cn=mail,ou=groups,dc=local"
          state: append
          attributes:
            uniqueMember:
              - uid=john,ou=people,dc=local
              - uid=jane,ou=people,dc=local

        # Domains
        - dn: dc=domain1,ou=domains,ou=mail,ou=services,dc=local
          attributes:
            objectClass: dNSDomain
            dc: domain1

        - dn: dc=domain2,ou=domains,ou=mail,ou=services,dc=local
          attributes:
            objectClass: dNSDomain
            dc: domain2

        # Aliases
        - dn: cn=postmaster@domain1,ou=aliases,ou=mail,ou=services,dc=local
          attributes:
            objectClass: nisMailAlias
            cn: postmaster@domain1
            rfc822MailMember: john.doe@domain1

        - dn: cn=webmaster@domain2,ou=aliases,ou=mail,ou=services,dc=local
          attributes:
            objectClass: nisMailAlias
            cn: webmaster@domain2
            rfc822MailMember: jane.doe@domain2

      ldap_server_consumers:
        - name: postfix
          password: postfixpassword
        - name: dovecot
          password: dovecotpassword
          state: present

      ldap_server_domain: "local"
      ldap_server_groups:
        - name: mail
      ldap_server_organization: "Example"
      ldap_server_tls_certificate: "{{ lookup('file', 'tests/data/x509/ldap-server_ldap.cert.pem') }}"
      ldap_server_tls_key: "{{ lookup('file', 'tests/data/x509/ldap-server_ldap.key.pem') }}"

      # common
      ca_certificates:
        testca: "{{ lookup('file', 'tests/data/x509/ca.cert.pem') }}"

      # ldap_client
      ldap_client_config:
        - comment: CA truststore
          option: TLS_CACERT
          value: /etc/ssl/certs/testca.cert.pem
        - comment: Ensure TLS is enforced
          option: TLS_REQCERT
          value: demand
        - comment: Base DN
          option: BASE
          value: dc=local
        - comment: URI
          option: URI
          value: ldapi:///

    - role: backup_server
      backup_host_ssh_private_keys:
        dsa: "{{ lookup('file', 'tests/data/ssh/server_dsa') }}"
        rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"
        ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"
        ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"
      backup_clients:
        - server: parameters-optional
          ip: 10.31.127.31
          public_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional.pub') }}"

- hosts: parameters-mandatory
  roles:
    - role: mail_server
      mail_ldap_base_dn: dc=local
      mail_ldap_url: ldap://ldap-server/
      mail_ldap_postfix_password: postfixpassword
      mail_ldap_dovecot_password: dovecotpassword

      # Common parameters (general, not role).
      tls_certificate_dir: tests/data/x509/
      tls_private_key_dir: tests/data/x509/

      # common
      ca_certificates:
        testca: "{{ lookup('file', 'tests/data/x509/ca.cert.pem') }}"

- hosts: parameters-optional
  roles:
    - role: mail_server
      mail_ldap_base_dn: dc=local
      mail_ldap_url: ldap://ldap-server/
      mail_ldap_tls_truststore: "{{ lookup('file', 'tests/data/x509/ca.cert.pem') }}"
      mail_ldap_postfix_password: postfixpassword
      mail_ldap_dovecot_password: dovecotpassword
      mail_server_tls_protocols:
        - TLSv1.2
        - TLSv1.1
      mail_server_tls_ciphers: "DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:!aNULL:!MD5:!EXPORT"
      mail_user: virtmail
      mail_user_uid: 5000
      mail_user_gid: 5000
      imap_max_user_connections_per_ip: 2
      imap_tls_certificate: "{{ lookup('file', 'tests/data/x509/parameters-optional_imap.cert.pem') }}"
      imap_tls_key: "{{ lookup('file', 'tests/data/x509/parameters-optional_imap.key.pem') }}"
      local_mail_aliases:
        root: "john.doe@domain1"
      smtp_tls_certificate: "{{ lookup('file', 'tests/data/x509/parameters-optional_smtp.cert.pem') }}"
      smtp_tls_key: "{{ lookup('file', 'tests/data/x509/parameters-optional_smtp.key.pem') }}"
      imap_folder_separator: "."
      smtp_rbl:
        - bl.spamcop.net
        - zen.spamhaus.org

      mail_postmaster: "webmaster@parameters-optional"
      smtp_allow_relay_from:
        - 10.31.127.20

      # common
      ca_certificates:
        testca: "{{ lookup('file', 'tests/data/x509/ca.cert.pem') }}"

      # backup_client
      enable_backup: yes
      backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"
      backup_server: ldap-server
      backup_server_host_ssh_public_keys:
        - "{{ lookup('file', 'tests/data/ssh/server_dsa.pub') }}"
        - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"
        - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"
        - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"
      backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"