- name: Install packages inside jail
  loop:
    - { jail: ingress, package: nginx }
    - { jail: ingress, package: py311-certbot }
    - { jail: ingress, package: py311-certbot-nginx }
    - { jail: ingress, package: goaccess }
  include_tasks: pkg_jail_install.yml

- name: Configure pf.conf
  template:
    src: ingress/etc_pf.conf.j2
    dest: /usr/local/jails/containers/ingress/etc/pf.conf
    owner: root
    group: wheel
    mode: "0644"

- name: Reload pf.conf
  shell: jexec ingress pfctl -f /etc/pf.conf

- name: Enable gateway mode
  shell: jexec ingress sysrc gateway_enable=YES && jexec ingress sysctl net.inet.ip.forwarding=1

- name: Enable pf
  shell: jexec ingress sysrc pf_enable=YES

- name: Check if pf is running
  shell: service -j ingress pf status
  register: pf_status
  changed_when: pf_status.rc != 0

- name: Start pf
  shell: service -j ingress pf start
  when: pf_status.rc != 0
#
#- name: Generate LetsEncrypt certs
#  shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
#  loop: "{{ ingress_routes | map(attribute='host') | unique }}"

# It's important to run this after generating certs, because nginx.conf refers to files
# generated by certbot. Certbot will fail validation if nginx.conf is configured too early.
- name: Configure nginx.conf
  template:
    src: ingress/usr_local_etc_nginx_nginx.conf.j2
    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
    owner: root
    group: wheel
    mode: "0644"
  register: nginx_conf

- name: Create static directories
  loop: "{{ ingress_routes | selectattr('static', 'defined') | map(attribute='static') | unique | list }}"
  file:
    path: "/usr/local/jails/containers/ingress{{ item }}"
    state: directory
    recurse: yes
    owner: 80
    group: 80
    mode: "0755"

- name: Check if nginx is enabled
  shell: service -j ingress nginx status
  changed_when: false
  failed_when: false
  register: ingress_nginx_enabled

- name: Enable and start nginx
  shell: |
    service -j ingress nginx enable
    service -j ingress nginx onestart
  when: ingress_nginx_enabled.rc != 0

- name: Install hetzner_ddns.sh
  template:
    src: ingress/usr_local_bin_hetzner_ddns.sh.j2
    dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Set up hetzner_auth
  template:
    src: ingress/usr_local_etc_hetzner_auth.j2
    dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth
    owner: root
    group: wheel
    mode: "0600"

- name: Set up gen_goaccess.sh
  template:
    src: ingress/usr_local_bin_gen_goaccess.sh.j2
    dest: /usr/local/jails/containers/ingress/usr/local/bin/gen_goaccess.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Set up crontab
  template:
    src: ingress/etc_crontab.j2
    dest: /usr/local/jails/containers/ingress/etc/crontab
    owner: root
    group: wheel
    mode: "0644"
  vars:
    tls_hosts: "{{ ingress_routes | map(attribute='host') | unique }}"
  register: jail_ingress_etc_crontab

- name: Restart cron
  service:
    name: cron
    state: restarted
  when: jail_ingress_etc_crontab.changed