- name: Ensure ingress goaccess mount points exist
  file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: wheel
    mode: "0755"
  loop:
    - /usr/local/jails/containers/goaccess/var/www/goaccess
    - /usr/local/jails/containers/ingress/mnt/www_goaccess

- name: Start ingress jail
  shell: service jail start ingress
  register: ingress_jail_start
  failed_when: false
  changed_when: "'already running' not in ingress_jail_start.stderr"

- name: Install packages inside jail
  loop:
    - { jail: ingress, package: nginx }
    - { jail: ingress, package: py311-certbot }
    - { jail: ingress, package: py311-certbot-nginx }
    - { jail: ingress, package: goaccess }
  include_tasks: pkg_jail_install.yml

- name: Configure pf.conf
  template:
    src: ingress/etc_pf.conf.j2
    dest: /usr/local/jails/containers/ingress/etc/pf.conf
    owner: root
    group: wheel
    mode: "0644"
  register: ingress_pf_conf

- name: Reload pf.conf
  shell: jexec ingress pfctl -f /etc/pf.conf
  when: ingress_pf_conf.changed

- name: Check if gateway mode is enabled
  shell: jexec ingress sysrc gateway_enable | grep -q "YES"
  register: ingress_gateway_enabled
  failed_when: false
  changed_when: false

- name: Enable gateway mode
  shell: jexec ingress sysrc gateway_enable=YES
  when: ingress_gateway_enabled.rc != 0

- name: Check if IP forwarding is enabled
  shell: jexec ingress sysctl net.inet.ip.forwarding | grep -q "1"
  register: ingress_ip_forwarding_enabled
  failed_when: false
  changed_when: false

- name: Enable IP forwarding
  shell: jexec ingress sysctl net.inet.ip.forwarding=1
  when: ingress_ip_forwarding_enabled.rc != 0

- name: Install pf-ban-socket.py
  copy:
    src: templates/ingress/pf-ban-socket.py
    dest: /usr/local/jails/containers/ingress/usr/local/bin/pf-ban-socket.py
    owner: root
    group: wheel
    mode: "0755"
  register: ingress_pf_ban_socket_py

- name: Install pf-ban-socket service
  copy:
    src: templates/ingress/usr_local_etc_rc.d_pf_ban_socket
    dest: /usr/local/jails/containers/ingress/usr/local/etc/rc.d/pf_ban_socket
    owner: root
    group: wheel
    mode: "0755"
  register: ingress_pf_ban_socket_service

- name: Check if pf enabled
  shell: jexec ingress sysrc pf_enable | grep -q "YES"
  register: ingress_pf_enabled
  failed_when: false
  changed_when: false

- name: Enable pf
  shell: jexec ingress sysrc pf_enable=YES
  when: ingress_pf_enabled.rc != 0

- name: Check if pf is running
  shell: service -j ingress pf status
  register: ingress_pf_status
  changed_when: ingress_pf_status.rc != 0

- name: Start pf
  shell: service -j ingress pf start
  when: ingress_pf_status.rc != 0

- name: Enable pf-ban-socket service
  shell: |
    service -j ingress pf_ban_socket enable
    service -j ingress pf_ban_socket restart
  when: ingress_pf_ban_socket_service.changed or ingress_pf_ban_socket_py.changed

- name: Copy acme-dns-auth.py
  copy:
    src: templates/ingress/acme-dns-auth.py
    dest: /usr/local/jails/containers/ingress/usr/local/bin/acme-dns-auth.py
    owner: root
    group: wheel
    mode: "0755"

- name: Check if LetsEncrypt certs are generated
  shell: ls /usr/local/jails/containers/ingress/usr/local/etc/letsencrypt/live/{{ cert_name }}
  register: cert_exists
  failed_when: false
  changed_when: false

- name: Manually get certs with certbot and DNS challenge
  pause:
    prompt: |
      /usr/local/etc/letsencrypt/live/{{ cert_name }} does not exist. This means that this is the first run of this playbook.
      The {{ cert_name }} cert contains all of the @ and * certs for all domains.
      Check the ingress crontab template and run the certbot command manually in the ingress jail. Remove the "-n" flag.
      Add the requested DNS records manually into Hetzner DNS. Continue after this is done.
  when: cert_exists.rc != 0

- name: Configure nginx.conf
  template:
    src: ingress/usr_local_etc_nginx_nginx.conf.j2
    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
    owner: root
    group: wheel
    mode: "0644"
  register: nginx_conf

- name: Create nginx snippets directory
  file:
    path: "/usr/local/jails/containers/ingress/usr/local/etc/nginx/snippets"
    state: directory
    owner: root
    group: wheel
    mode: "0755"

- name: Include ban.inc
  template:
    src: ingress/nginx_snippet_ban.inc
    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/snippets/ban.inc
    owner: root
    group: wheel
    mode: "0644"

- name: Create static directories
  loop: "{{ ingress_routes | selectattr('static', 'defined') | map(attribute='static') | unique | list }}"
  file:
    path: "/usr/local/jails/containers/ingress{{ item }}"
    state: directory
    recurse: yes
    owner: 80
    group: 80
    mode: "0755"

- name: Check if nginx is enabled
  shell: service -j ingress nginx status
  changed_when: false
  failed_when: false
  register: ingress_nginx_enabled

- name: Enable and start nginx
  shell: |
    service -j ingress nginx enable
    service -j ingress nginx restart
  when: ingress_nginx_enabled.rc != 0 or nginx_conf.changed

- name: Install hetzner_ddns.sh
  template:
    src: ingress/usr_local_bin_hetzner_ddns.sh.j2
    dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Set up hetzner_auth
  template:
    src: ingress/usr_local_etc_hetzner_auth.j2
    dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth
    owner: root
    group: wheel
    mode: "0600"

- name: Set up gen_goaccess.sh
  template:
    src: ingress/usr_local_bin_gen_goaccess.sh.j2
    dest: /usr/local/jails/containers/ingress/usr/local/bin/gen_goaccess.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Set up crontab
  template:
    src: ingress/etc_crontab.j2
    dest: /usr/local/jails/containers/ingress/etc/crontab
    owner: root
    group: wheel
    mode: "0644"
  vars:
    tls_hosts: "{{ ingress_routes | map(attribute='host') | unique }}"
  register: jail_ingress_etc_crontab

- name: Restart cron
  service:
    name: cron
    state: restarted
  when: jail_ingress_etc_crontab.changed