---
- name: start httpd (provided in the apache role)
  service: name=httpd state=started

- name: ensure packages required for vault are installed (dnf)
  dnf: name={{ item }} state=present
  with_items:
    - vault
    - python3-mod_wsgi
    - python3-psycopg2
    - python3-flask-oidc
    - python2-libsemanage
  when: ansible_cmdline.ostree is not defined and deployment_type in ['dev', stg']

###########
## TODO: remove when transition to buildbot 1.7 is complete
- name: ensure packages required for vault are installed (dnf)
  dnf: name={{ item }} state=present
  with_items:
    - vault
    - mod_wsgi
    - python-psycopg2
    - libsemanage-python
  when: ansible_cmdline.ostree is not defined and deployment_type in ['prod']
###########

- name: ensure database is created
  delegate_to: "{{ vault_db_host_machine }}"
  become_user: postgres
  become: true
  postgresql_db: db={{ vault_db_name }}

- name: ensure vault db user has access to database
  delegate_to: "{{ vault_db_host_machine }}"
  become_user: postgres
  become: true
  postgresql_user: db={{ vault_db_name }} user={{ vault_db_user }} password={{ vault_db_password }} role_attr_flags=NOSUPERUSER

- name: ensure selinux lets httpd talk to postgres
  seboolean: name=httpd_can_network_connect_db persistent=yes state=yes

- name: register with iddev
  command: python3 /usr/lib/python3.7/site-packages/flask_oidc/registration_util.py https://iddev.fedorainfracloud.org {{ vault_public_url }}
  args:
      chdir: /etc/vault
      creates: /etc/vault/client_secrets.json
  notify:
    - reload httpd

- name: generate vault config
  template: src=settings.py.j2 dest=/etc/vault/settings.py owner=root group=root mode=0644
  notify:
    - reload httpd

- name: generate vault apache config
  template: src=vault.conf.j2 dest=/etc/httpd/conf.d/vault.conf owner=root group=root mode=0644
  notify:
    - reload httpd

- name: generate alembic.ini
  template: src=alembic.ini.j2 dest=/usr/share/vault/alembic.ini owner=root group=root mode=0644

- name: initialize vault database
  shell: PROD='true' vault init_db

- name: initialize alembic
  shell: PROD='true' vault init_alembic

- name: upgrade vault database via alembic
  shell: PROD='true' vault upgrade_db
