---
# The acme hook is named after the service, because that is the name the client
# uses to reload it: apache2 on deb, httpd on EL.
- name: apache-letsencrypt | Managed
  when: apache_letsencrypt_managed
  tags: [ 'apache', 'letsencrypt' ]
  block:
    - name: apache-letsencrypt | Enable the proxy modules needed by letsencrypt, deb systems
      community.general.apache2_module:
        name: '{{ item }}'
        state: present
      with_items: '{{ apache_letsencrypt_proxy_modules }}'
      when: ansible_distribution_file_variety == "Debian"
      notify: apache2 reload

    - name: apache-letsencrypt | Install the letsencrypt directives, deb systems
      ansible.builtin.template:
        src: '{{ item }}.j2'
        dest: '{{ apache_base_conf_dir }}/conf-available/{{ item }}'
        owner: root
        group: root
        mode: '0644'
      with_items: '{{ apache_letsencrypt_proxy_conf }}'
      when: ansible_distribution_file_variety == "Debian"
      notify: apache2 reload

    - name: apache-letsencrypt | Enable the letsencrypt directives, deb systems
      ansible.builtin.file:
        src: '{{ apache_base_conf_dir }}/conf-available/{{ item }}'
        dest: '{{ apache_base_conf_dir }}/conf-enabled/{{ item }}'
        state: link
      with_items: '{{ apache_letsencrypt_proxy_conf }}'
      when: ansible_distribution_file_variety == "Debian"
      notify: apache2 reload

    # EL has no conf-available and conf-enabled: everything under conf.d is read,
    # and the 00- prefix puts these directives before the virtualhosts.
    - name: apache-letsencrypt | Install the letsencrypt directives, EL systems
      ansible.builtin.template:
        src: '{{ item }}.j2'
        dest: '{{ apache_base_conf_dir }}/conf.d/00-{{ item }}'
        owner: root
        group: root
        mode: '0644'
      with_items: '{{ apache_letsencrypt_proxy_conf }}'
      when: ansible_distribution_file_variety == "RedHat"
      notify: apache2 reload

    - name: apache-letsencrypt | Create the acme hooks directory if it does not yet exist
      ansible.builtin.file:
        dest: '{{ letsencrypt_acme_services_scripts_dir }}'
        state: directory
        owner: root
        group: root
        mode: '0755'

    - name: apache-letsencrypt | Install the letsencrypt hook
      ansible.builtin.copy:
        src: apache-letsencrypt-acme.sh
        dest: '{{ letsencrypt_acme_services_scripts_dir }}/{{ apache_service_name }}'
        owner: root
        group: root
        mode: '4555'

- name: apache-letsencrypt | Not managed
  when: not apache_letsencrypt_managed
  tags: [ 'apache', 'letsencrypt' ]
  block:
    - name: apache-letsencrypt | Disable the letsencrypt conf, deb systems
      ansible.builtin.file:
        dest: '{{ apache_base_conf_dir }}/conf-enabled/letsencrypt-proxy.conf'
        state: absent
      when: ansible_distribution_file_variety == "Debian"
      notify: apache2 reload

    - name: apache-letsencrypt | Remove the letsencrypt conf, EL systems
      ansible.builtin.file:
        dest: '{{ apache_base_conf_dir }}/conf.d/00-letsencrypt-proxy.conf'
        state: absent
      when: ansible_distribution_file_variety == "RedHat"
      notify: apache2 reload

    - name: apache-letsencrypt | Remove the letsencrypt hook
      ansible.builtin.file:
        path: '{{ letsencrypt_acme_services_scripts_dir }}/{{ apache_service_name }}'
        state: absent