- name: Create directory and templated file
  hosts: nuculabs
  become: true
  become_method: sudo
  vars_files:
    - variables.yaml

  tasks:
    # Create necessary directories.
    - name: "Create directories"
      block:
        - name: Create PeerTube data directory
          ansible.builtin.file:
            path: "{{ peertube.base_directory }}/data"
            state: directory
            mode: "0755"
          ignore_errors: true
        - name: Create PeerTube config directory
          ansible.builtin.file:
            path: "{{ peertube.base_directory }}/config"
            state: directory
            mode: "0754"
          ignore_errors: true
        - name: Create PostgresSQL directory
          ansible.builtin.file:
            path: "{{ postgres.postgres_directory }}"
            state: directory
            mode: "0754"
          ignore_errors: true
        - name: Create Backups directory
          ansible.builtin.file:
            path: "{{ peertube.backups_directory }}"
            state: directory
            mode: "0754"
          ignore_errors: true
    # Ensure dependencies are installed
    - name: "Install dependencies"
      block:
        - name: Ensure Podman is installed
          ansible.builtin.package:
            name: podman
            state: present
        - name: Ensure Udica is installed
          ansible.builtin.package:
            name: udica
            state: present
        - name: Ensure container-selinux is installed
          ansible.builtin.package:
            name: container-selinux
            state: present
    # Pull docker images
    - name: "Pull container images"
      block:
        - name: Pull PeerTube image
          containers.podman.podman_image:
            name: "{{ peertube.image_name }}"
            state: present
        - name: Pull Postgres image
          containers.podman.podman_image:
            name: "{{ postgres.image_name }}"
            state: present
        - name: Pull Redis image
          containers.podman.podman_image:
            name: "{{ redis.image_name }}"
            state: present
    - name: Add firewall ports
      block:
        - name: Create firewalld service
          ansible.builtin.copy:
            src: ./templates/firewall/peertube.xml
            dest: /etc/firewalld/services/peertube.xml
            mode: "0644"
          notify:
            - reload firewalld
        - name: Enable firewalld service
          ansible.posix.firewalld:
            service: peertube
            state: enabled
            permanent: true
            immediate: true
            offline: true
          notify:
            - reload firewalld
    - name: "Load CIL policies"
      block:
        - name: Copy peertube cil
          ansible.builtin.copy:
            src: ./templates/cil/peertube.cil
            dest: /tmp/peertube.cil
            mode: "0644"
        - name: Copy postgres cil
          ansible.builtin.copy:
            src: ./templates/cil/postgres.cil
            dest: /tmp/postgres.cil
            mode: "0644"
        - name: Load PeertTube CIL policy
          ansible.builtin.command:
            argv:
              - semodule
              - -i
              - /tmp/peertube.cil
              - /usr/share/udica/templates/base_container.cil
              - /usr/share/udica/templates/net_container.cil
        - name: Load Postgres CIL policy
          ansible.builtin.command:
            argv:
              - semodule
              - -i
              - /tmp/postgres.cil
              - /usr/share/udica/templates/base_container.cil
              - /usr/share/udica/templates/net_container.cil
        - name: "Allow samba access from container"
          ansible.builtin.command:
            argv:
              - semanage
              - boolean
              - -m
              - virt_use_samba
              - --on
  handlers:
    - name: reload firewalld
      ansible.builtin.service:
        name: firewalld
        state: reloaded