- name: Set up resolv.conf
  template:
    src: etc_resolv.conf.j2
    dest: /etc/resolv.conf
    owner: root
    group: wheel
    mode: "0644"
  register: resolv_conf

- name: Make resolv.conf immutable
  shell: chflags schg /etc/resolv.conf
  when: resolv_conf.changed

- name: Restart networking if interface configuration changed
  shell: service netif restart && service routing restart
  when: rc_conf.changed or resolv_conf.changed

- name: Set up sshd
  template:
    src: etc_ssh_sshd_config.j2
    dest: /etc/ssh/sshd_config
    owner: root
    group: wheel
    mode: "0644"
  register: etc_sshd_config

- name: Start sshd
  service:
    name: sshd
    state: started
  register: started_sshd

- name: Restart sshd
  service:
    name: sshd
    state: restarted
  when: not started_sshd.changed and etc_sshd_config.changed

- name: Start syslogd
  service:
    name: syslogd
    state: started
  register: started_syslogd

- name: Restart syslogd
  service:
    name: syslogd
    state: restarted
  when: not started_syslogd.changed and rc_conf.changed

- name: Configure pf
  template:
    src: etc_pf.conf.j2
    dest: /etc/pf.conf
    owner: root
    group: wheel
    mode: "0644"
    backup: yes
  register: pf_conf

- name: Start pf
  service:
    name: pf
    state: started

- name: Reload pf rules
  shell: pfctl -f /etc/pf.conf
  when: pf_conf.changed

- name: Configure nginx.conf
  template:
    src: usr_local_etc_nginx_nginx.conf.j2
    dest: /usr/local/etc/nginx/nginx.conf
    owner: root
    group: wheel
    mode: "0644"
  register: nginx_conf

- name: Generate LetsEncrypt certs
  shell: certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
  loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"
  when: nginx_conf.changed

- name: Copy over jan.systems HTML
  ansible.posix.synchronize:
    src: "{{ jan_systems_html_dir.rstrip('/') + '/' }}"
    dest: /usr/local/www/jan.systems

- name: Start nginx
  service:
    name: nginx
    state: started
  register: started_nginx

- name: Restart nginx
  service:
    name: nginx
    state: restarted
  when: not started_nginx.changed and nginx_conf.changed

- name: Set up restore_jail_aliases.sh
  template:
    src: usr_local_bin_restore_jail_aliases.sh.j2
    dest: /usr/local/bin/restore_jail_aliases.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Set up devd lan0_jail_restore.conf
  template:
    src: etc_devd_lan0_jail_restore.conf.j2
    dest: /etc/devd/lan0_jail_restore.conf
    owner: root
    group: wheel
    mode: "0644"

- name: Set up /usr/local/etc/do_dyndns_auth
  template:
    src: usr_local_etc_do_dyndns_auth.j2
    dest: /usr/local/etc/do_dyndns_auth
    owner: root
    group: wheel
    mode: "0600"

- name: Set up /usr/local/bin/do_dyndns.sh
  template:
    src: usr_local_bin_do_dyndns.sh.j2
    dest: /usr/local/bin/do_dyndns.sh
    owner: root
    group: wheel
    mode: "0755"
  register: do_dyndns_sh

- name: Set up /usr/local/etc/rc.d/do_dyndns
  template:
    src: usr_local_etc_rc.d_do_dyndns.j2
    dest: /usr/local/etc/rc.d/do_dyndns
    owner: root
    group: wheel
    mode: "0755"
  register: do_dyndns_rc

- name: Start do_dyndns
  service:
    name: do_dyndns
    state: started
  register: do_dyndns_start

- name: Restart do_dyndns
  service:
    name: do_dyndns
    state: restarted
  when: not do_dyndns_start.changed and (do_dyndns_sh.changed or do_dyndns_rc.changed)