---
- block:
  - name: Install the apache letsencrypt directives on trusty
    template: src=letsencrypt-proxy.conf.j2 dest=/etc/apache2/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
    when:  ansible_distribution_file_variety == "Debian"
    notify: httpd reload
    
  - name: Install the apache letsencrypt directives on CentOS
    template: src=letsencrypt-proxy.conf.j2 dest=/etc/httpd/conf.d/letsencrypt-proxy.conf owner=root group=root mode=0644
    when:  ansible_distribution_file_variety == "RedHat"
    notify: httpd reload
    
  - name: Create the acme hooks directory if it does not yet exist
    file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root

  - name: Install a letsencrypt hook that fixes the letsencrypt certificate for ipa and then reloads the service
    template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=0550
    when: ipa_ssl_letsencrypt_use_hook | bool

  - name: Install a script that fixes the letsencrypt certificate for ipa and then reloads the service
    template: src=ipa-letsencrypt-acmetool.sh dest=/usr/local/bin/ipa-letsencrypt owner=root group=root mode=0500
    when: not ipa_ssl_letsencrypt_use_hook | bool
    tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]

  - name: Install a cron job that runs the ipa-letsencrypt script
    cron: name="Refresh-the-letsencrypt-certificate-configured-in-FreeIPA" job="/usr/local/bin/ipa-letsencrypt >/var/log/acme/ipa-letsencrypt.log 2>&1" user=root hour="{{ range(1, 4) | random }}" minute="{{ range(0, 59) | random }}" day={{ ipa_letsencrypt_cron_job_day }} state=present
    when: not ipa_ssl_letsencrypt_use_hook | bool
    tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt', 'ipa_letsencrypt_cron' ]

  - name: Create the ipa certificate directory
    file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750

  - name: Install the Letsencrypt CA file with both the root and the trusted CAs
    copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0440

  - name: Copy the certificate file into /etc/pki/ipa
    copy: src={{ letsencrypt_acme_certs_dir }}/fullchain dest=/etc/pki/ipa/cert.pem remote_src=True force=True  mode=0440

  - name: Copy the certificate key file into /etc/pki/ipa
    copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest=/etc/pki/ipa/cert-key.pem remote_src=True force=True  mode=0440

  - name: Put chain and cert in a single file. Needed once for the first configuration
    shell: cat /etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} /etc/pki/ipa/cert.pem /etc/pki/ipa/cert-key.pem > /etc/pki/ipa/fullchain.pem ; chmod 400 /etc/pki/ipa/fullchain.pem
    args:
      creates: '/etc/pki/ipa/fullchain.pem'

  when:
    - ipa_ssl_letsencrypt_managed | bool
    - letsencrypt_acme_install | bool
  tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt' ]

- block:
  - name: Install the FreeIPA server packages
    yum: pkg={{ ipa_server_packages }} state=latest

  - name: Install the FreeIPA DNS server packages
    yum: pkg={{ ipa_server_dns_packages }} state=latest

  - name: Remove the packages that conflict with the FreeIPA server configuration
    yum: pkg={{ ipa_packages_to_remove }} state=absent

  - name: Ensure that the ntpd service is started and enabled
    service: name=ntpd state=started enabled=yes

  when:
    - ipa_server_install | bool
    - ansible_distribution_file_variety == "RedHat"
  tags: [ 'ipa' ]

- block:
  - name: Run the ipa-server-install command unattended.
    command: ipa-server-install {{ ipa_installation_options }}
    args:
      creates: /var/lib/ipa/dnssec/softhsm_pin
    
  when:
    - ipa_server_install | bool
    - ipa_server_is_master | bool
    - ansible_distribution_file_variety == "RedHat"
    - ipa_run_the_installation_command | bool
  tags: [ 'ipa' ]