---

# Main implementation
# ===================

- name: Set-up the Debian backports repository
  template:
    src: backports.list.j2
    dest: /etc/apt/sources.list.d/backports.list
    owner: root
    group: root
    mode: 0644
  register: backports_repository_configuration

- name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa 503
  # [503] Tasks that run when changed should likely be handlers
  #   Since apt_repository module is not reliable (does not deploy
  #   change when changing distro version etc), we have to use
  #   template instead, but this also means we need to trigger the apt
  #   cache reload by hand.
  apt:
    update_cache: true
  when: backports_repository_configuration.changed

- name: Drop package pins to backports for Prosody on Debian 11 Bullseye
  file:
    path: /etc/apt/preferences.d/prosody
    state: absent
  when: ansible_distribution_release == 'bullseye'

- name: Install additional Prosody dependencies
  apt:
    name:
      - lua-ldap
      - prosody-modules
    state: present
  notify:
    - Restart Prosody

- name: Install Prosody
  apt:
    name: prosody
    state: present
  notify:
    - Restart Prosody

- name: Allow Prosody user to traverse the directory with TLS private keys
  user:
    name: prosody
    append: true
    groups: ssl-cert

- name: Deploy XMPP TLS private key
  copy:
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key"
    content: "{{ xmpp_tls_key }}"
    owner: root
    group: prosody
    mode: 0640
  notify:
    - Restart Prosody

- name: Deploy XMPP TLS certificate
  copy:
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
    content: "{{ xmpp_tls_certificate }}"
    owner: root
    group: root
    mode: 0644
  notify:
    - Restart Prosody

- name: Generate the XMPP server Diffie-Hellman parameter
  openssl_dhparam:
    owner: root
    group: prosody
    mode: 0640
    path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"
    size: 2048
  notify:
    - Restart Prosody

- name: Deploy configuration file for checking certificate validity via cron
  copy:
    content: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
    dest: "/etc/check_certificate/{{ ansible_fqdn }}_xmpp.conf"
    owner: root
    group: root
    mode: 0644

- name: Deploy script for validating Prosody certificate
  copy:
    src: "check_prosody_certificate.sh"
    dest: "/usr/local/bin/check_prosody_certificate.sh"
    owner: root
    group: root
    mode: 0755

- name: Set-up crontab task that runs the Prosody certificate checker script once a day
  copy:
    src: "cron_check_prosody_certificate"
    dest: "/etc/cron.d/check_prosody_certificate"
    owner: root
    group: root
    mode: 0644

- name: Deploy LDAP client configuration (for validating LDAP server certificate)
  copy:
    src: prosody_ldaprc
    dest: "/var/lib/prosody/.ldaprc"
    owner: root
    group: prosody
    mode: 0640
  notify:
    - Restart Prosody

- name: Deploy Prosody configuration file
  template:
    src: "prosody.cfg.lua.j2"
    dest: "/etc/prosody/prosody.cfg.lua"
    owner: root
    group: prosody
    mode: 0640
  notify:
    - Restart Prosody

- name: Enable and start Prosody service
  service:
    name: prosody
    state: started
    enabled: true

- name: Deploy firewall configuration for XMPP server
  copy:
    src: "ferm_xmpp.conf"
    dest: "/etc/ferm/conf.d/30-xmpp.conf"
    owner: root
    group: root
    mode: 0640
  notify:
    - Restart ferm

- name: Explicitly run all handlers
  include: ../handlers/main.yml
  when: "run_handlers | default(False) | bool()"
  tags:
    - handlers