---
#
# Setup koji hub server.
#
- name: install koji hub server packages
  package: name={{ item }} state=present
  with_items:
  - koji-hub
  - koji-hub-plugins
  - koji-web
  - koji-utils
  - koji-theme-fedora
  - koji-containerbuild-hub
  - mod_ssl
  - mod_wsgi
  - mod_auth_gssapi
  - git
  - gnupg2
  tags:
  - packages
  - koji_hub

#
# Setup koji hub osbuild plugin.
#
- name: install image builder server packages
  package: name={{ item }} state=present
  with_items:
  - koji-osbuild-hub
  notify:
  - restart kojira
  tags:
  - packages
  - koji_hub
  - koji_hub_osbuild

- name: make koji pki directory
  file: state=directory path=/etc/pki/koji/ owner=root group=root

- name: make koji pki subdirectories
  file: state=directory path=/etc/pki/koji/{{ item }} owner=root group=root
  with_items:
  - certs
  - private
  - confs
  tags:
  - koji_hub

- name: fedmenu shim
  template: src=fedmenu-extra-footer.html dest=/usr/share/koji-web/static/extra-footer.html
  tags: koji_hub
  notify: reload httpd
  # XXX - we only want to do this in staging for now because it requires a patch
  # to koji itself to include the extra-footer.html file in a sufficiently
  # advanced way.
  # https://lists.fedoraproject.org/pipermail/buildsys/2015-April/004636.html
  when: env == 'staging'

- name: set the apache mpm to use event MPM
  copy: src=00-mpm.conf dest=/etc/httpd/conf.modules.d/00-mpm.conf
  notify:
  - reload proxyhttpd
  tags:
  - config
  - koji_hub

- name: hub config
  template: src=hub.conf.j2 dest=/etc/koji-hub/hub.conf owner=apache group=apache mode=600
  tags:
  - config
  - koji_hub
  - koji_hub_osbuild
  notify: reload httpd

- name: kojiweb config
  template: src=web.conf.j2 dest=/etc/kojiweb/web.conf owner=apache group=apache mode=600
  tags:
  - config
  - koji_hub
  notify: reload httpd

- name: enable httpd_can_network_connect SELinux boolean for fedmsg
  seboolean: name=httpd_can_network_connect state=yes persistent=yes
  tags:
  - config
  - selinux
  - koji_hub

- name: enable httpd_use_nfs SELinux boolean for fedmsg
  seboolean: name=httpd_use_nfs state=yes persistent=yes
  tags:
  - config
  - selinux
  - koji_hub

- name: install fedora-messaging as a dependency for the plugin (rhel7)
  package: name={{ item }} state=present
  with_items:
  - python2-fedora-messaging
  - python2-koji-sidetag-plugin-hub
  tags:
  - packages
  - koji_hub
  - fedora-messaging
  when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 7

- name: install fedora-messaging as a dependency for the plugin (fedora)
  package: name={{ item }} state=present
  with_items:
  - python3-fedora-messaging
  tags:
  - packages
  - koji_hub
  - fedora-messaging
  when: ansible_distribution == "Fedora"

- name: create the config folder for fedora-messaging
  file: path=/etc/fedora-messaging/ owner=root group=root mode=0755 state=directory
  tags:
  - koji_hub
  - fedora-messaging

- name: install the configuration file for fedora-messaging
  template:
      src=fedora-messaging.toml
      dest=/etc/fedora-messaging/config.toml
  tags:
  - config
  - koji_hub
  - fedora-messaging

- name: create folder where we'll place the certs
  file: path=/etc/pki/rabbitmq/kojicert/ owner=root group=root mode=0755 state=directory
  tags:
  - config
  - koji_hub
  - fedora-messaging

- name: deploy koji/rabbitmq certificate
  copy: src={{ item.src }}
        dest=/etc/pki/rabbitmq/kojicert/{{ item.dest }}
        owner={{ item.owner }} group=root mode={{ item.mode }}
  with_items:
    - src: "{{private}}/files/rabbitmq/{{env}}/pki/issued/koji{{ env_suffix }}.crt"
      dest: koji.crt
      owner: apache
      mode: 0644
    - src: "{{private}}/files/rabbitmq/{{env}}/pki/private/koji{{ env_suffix }}.key"
      dest: koji.key
      owner: apache
      mode: "600"
    - src: "{{private}}/files/rabbitmq/{{env}}/pki/ca.crt"
      dest: koji.ca
      owner: apache
      mode: 0644
  tags:
  - config
  - koji_hub
  - fedora-messaging

# install the plugin with the rpm from infra repo on stg
- name: install fedora-messaging schemas and plugin
  package: name={{ item }} state=present
  with_items:
  - koji-fedoramessaging
  - python3-koji-fedoramessaging-messages
  notify:
  - reload httpd
  tags:
  - packages
  - koji_hub
  - fedora-messaging
  when: ansible_distribution == "Fedora"


- name: install the configuration file for the sidetag plugin
  copy:
    src: sidetag.conf
    dest: /etc/koji-hub/plugins/sidetag.conf
  tags:
  - koji_hub

#
# rpmautospec plugin
#

- name: uninstall koji hub rpmautospec plugin
  package: name={{ item }} state=absent
  with_items:
  - koji-hub-plugin-rpmautospec
  tags:
  - packages
  - koji_hub
  - rpmautospec

- name: remove obsolete configuration for rpmautospec
  file:
    path: "/etc/koji-hub/plugins/{{ item }}"
    state: absent
  loop:
    - rpmautospec.conf
    - rpmautospec.conf.rpmnew
    - rpmautospec.conf.rpmsave
    - rpmautospec.conf.rpmorig
  tags:
  - koji_hub
  - rpmautospec

#
# install keytabs
#

- name: install koji-hub keytab
  copy: src={{ private }}/files/keytabs/{{ env }}/koji-hub-{{ fedmsg_koji_instance }} dest=/etc/koji-hub/koji-hub.keytab
        owner=apache group=apache mode=0600
  notify:
  - reload httpd
  tags:
  - config
  - koji_hub

- name: install GSSAPI keytab
  copy: src={{ private }}/files/keytabs/{{ env }}/koji-gssapi dest=/etc/koji-hub/gssapi.keytab
        owner=apache group=apache mode=0600
  notify:
  - reload httpd
  tags:
  - config
  - koji_hub

#
# install production certs and keys
#
- name: install kojiweb_cert_key.pem
  copy: src={{ private }}/files/koji/kojiweb_cert_key.pem dest=/etc/pki/tls/private/kojiweb_cert_key.pem owner=apache mode=600
  notify:
  - reload httpd
  tags:
  - config
  - koji_hub
  when: env != 'staging' and ansible_hostname.startswith('koji')

- name: install production koji_cert.pem
  copy: src={{ private }}/files/koji/koji_cert.pem dest=/etc/pki/tls/certs/koji_cert.pem owner=apache mode=600
  notify:
  - reload httpd
  tags:
  - config
  - koji_hub
  when: env != 'staging' and ansible_hostname.startswith('koji')

- name: install production koji_key.pem
  copy: src={{ private }}/files/koji/koji_key.pem dest=/etc/pki/tls/private/koji_key.pem owner=apache mode=600
  notify:
  - reload httpd
  tags:
  - config
  - koji_hub
  when: env != 'staging' and ansible_hostname.startswith('koji')

- name: instaall fedora-ca.cert in various places
  copy: src={{ private }}/files/fedora-ca.cert dest={{ item }} owner=apache
  with_items:
  - /etc/kojira/extras_cacert.pem
  - /etc/pki/tls/certs/extras_cacert.pem
  - /etc/pki/tls/certs/extras_upload_cacert.pem
  - /etc/pki/tls/certs/upload_cacert.pem
  tags:
  - config
  - koji_hub

- name: install kojira_cert_key
  copy: src={{ private }}/files/koji/kojira_cert_key.pem dest=/etc/kojira/kojira_cert_key.pem owner=apache mode=600
  tags:
  - config
  - koji_hub

- name: koji web common config files
  copy: src={{ item }} dest=/etc/httpd/conf.d/{{ item }} owner=root group=root
  with_items:
  - mash.conf
  - rel-eng.conf
  - repo.conf
  tags:
  - config
  - koji_hub
  notify: reload httpd

- name: koji web hub specific config files
  template: src={{ item }}.j2 dest=/etc/httpd/conf.d/{{ item }} owner=root group=root
  with_items:
  - kojiweb.conf
  - kojihub.conf
  tags:
  - config
  - koji_hub
  notify: reload httpd

- name: koji web staging config files
  copy: src=kojiweb.conf.stg dest=/etc/httpd/conf.d/kojiweb-stg.conf owner=root group=root
  tags:
  - config
  - koji_hub
  notify: reload httpd
  when: env == "staging"

- name: koji robots.txt config
  copy: src=robots.txt dest=/var/www/html/robots.txt
  tags:
  - config
  - koji_hub
  notify: reload httpd

- name: kojira log dir
  file: dest=/var/log/kojira owner=root group=root mode=0750 state=directory
  tags:
  - config
  - koji_hub
  - kojira

- name: kojira config
  template: src=kojira.conf.j2 dest=/etc/kojira/kojira.conf
  tags:
  - config
  - koji_hub
  notify:
  - restart kojira

- name: make an empty /mnt/fedora_koji for stg.
  file: state=directory path=/mnt/fedora_koji/koji owner=root group=root
  tags:
  - koji_hub
  when: env == "staging" and ansible_hostname.startswith('koji')

- name: make mnt/koji directory
  file: state=link src=/mnt/fedora_koji/koji dest=/mnt/koji owner=root group=root
  tags:
  - koji_hub
  when: ansible_hostname.startswith('koji')

- name: check selinux default context for /mnt/fedora_koji in staging
  command: matchpathcon /mnt/fedora_koji
  register: mnt_fedora_koji_context
  when: env == "staging"
  check_mode: no
  changed_when: "1 != 1"
  tags:
  - koji_hub
  - selinux

- name: /mnt/fedora_koji selinux file context
  command: semanage fcontext -a -t httpd_sys_rw_content_t "/mnt/fedora_koji(/.*)?"
  when: env == "staging" and
        mnt_fedora_koji_context.stdout.find('httpd_sys_rw_content_t') == -1
  tags:
  - koji_hub
  - selinux

- name: set sebooleans so koji can talk to the db
  seboolean: name=httpd_can_network_connect_db state=true persistent=true
  tags:
  - selinux
  - koji_hub

- name: set sebooleans so koji can run the fedora-messaging plugin
  seboolean: name=httpd_execmem state=true persistent=true
  tags:
  - selinux
  - koji_hub

- name: set sebooleans so koji can anon write
  seboolean: name=httpd_anon_write state=true persistent=true
  tags:
  - selinux
  - koji_hub
  when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 7

- name: Set httpd to run on boot
  service: name=httpd enabled=yes
  ignore_errors: true
  notify:
  - reload httpd
  tags:
  - service
  - koji_hub

- name: Make sure kojira is set to run on boot
  service: name=kojira enabled=yes
  tags:
  - service
  - koji_hub
  when: ansible_hostname.startswith('koji02')

- name: install koji-gc.conf
  template: src=koji-gc.conf.j2 dest=/etc/koji-gc/koji-gc.conf
  tags:
  - koji_hub

- name: install prune-signed-copies-protected-tags config for prunesigs
  template: src=prune-signed-copies-protected-tags.j2 dest=/etc/prune-signed-copies-protected-tags
  tags:
  - koji_hub

- name: install cron jobs in /usr/local/etc/
  copy: src={{ item }} dest=/usr/local/etc/{{ item }}
  with_items:
  - koji-directory-cleanup
  - koji-gc
  - koji-prune-signed-copies
  - koji-sidetag-cleanup
  tags:
  - files
  - koji_hub

- name: enable crons on koji02 normally.
  copy: src={{ item }} dest=/etc/cron.d/{{ item }}
  with_items:
  - koji-directory-cleanup
  - koji-gc
  - koji-prune-signed-copies
  - koji-sidetag-cleanup
  tags:
  - files
  when: env != 'staging' and ansible_hostname.startswith('koji02')

- name: Create shadow user
  user: name=koji_shadow
  when: "fedmsg_koji_instance != 'primary'"
  tags:
  - files
  - koji_hub

- name: disable systemd-oomd we do not need or want it
  service: name=systemd-oomd state=stopped enabled=no
  tags:
  - koji_hub
  - koji_hub/oomd
