- name: Install packages inside jail
  loop:
    - { jail: ingress, package: nginx }
    - { jail: ingress, package: py311-certbot }
    - { jail: ingress, package: py311-certbot-nginx }
  include_tasks: pkg_jail_install.yml

- name: Create static sites log dir
  file:
    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}
    state: directory
    owner: root
    group: wheel
    mode: "0755"
  loop: "{{ static_sites | map(attribute='site') | unique }}"

- name: Create access.log for static sites
  file:
    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/access.log
    state: touch
    owner: root
    group: wheel
    mode: "0644"
  loop: "{{ static_sites | map(attribute='site') | unique }}"

- name: Create error.log for static sites
  file:
    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/error.log
    state: touch
    owner: root
    group: wheel
    mode: "0644"
  loop: "{{ static_sites | map(attribute='site') | unique }}"

- name: Generate LetsEncrypt certs
  shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
  loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"

# It's important to run this after generating certs, because nginx.conf refers to files
# generated by certbot. Certbot will fail validation if nginx.conf is configured too early.
- name: Configure nginx.conf
  template:
    src: ingress/usr_local_etc_nginx_nginx.conf.j2
    dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf
    owner: root
    group: wheel
    mode: "0644"
  register: nginx_conf

- name: Copy over static HTML
  ansible.posix.synchronize:
    src: "{{ item.value.rstrip('/') + '/' }}"
    dest: /usr/local/jails/containers/ingress/usr/local/www/{{ item.key }}
  loop: "{{ static_site_dirs | dict2items }}"

- name: Check if nginx is enabled
  shell: service -j ingress nginx status
  changed_when: false
  failed_when: false
  register: ingress_nginx_enabled

- name: Enable and start nginx
  shell: |
    service -j ingress nginx enable
    service -j ingress nginx onestart
  when: ingress_nginx_enabled.rc != 0

- name: Set up crontab
  template:
    src: ingress/etc_crontab.j2
    dest: /usr/local/jails/containers/ingress/etc/crontab
    owner: root
    group: wheel
    mode: "0644"
  vars:
    # comma-separated list of sites
    items_list: "{{ static_sites + jails }}"
    items: "{{ items_list | selectattr('tls') | map(attribute='host') }}"
  register: jail_ingress_etc_crontab

- name: Restart cron
  service:
    name: cron
    state: restarted
  when: jail_ingress_etc_crontab.changed