---
- name: Install stuff
  apt:
    name:
      - apache2
    update_cache: yes

- name: install acme.sh
  include_role:
    name: acmesh

- name: enable apache modules
  command: a2enmod {{ item }}
  args:
    creates: /etc/apache2/mods-enabled/{{ item }}.load
  loop:
    - proxy
    - proxy_html
    - proxy_http
    - proxy_http2
    - proxy_wstunnel
    - ssl
    - headers
    - rewrite
  notify:
    reload apache2

- name: create directory for own root ca cert
  file:
    path: "/usr/local/share/ca-certificates/step-ca/"
    owner: root
    group: root
    mode: '0755'
    state: directory
  when: acme_sh_server is defined

- name: copy own root ca cert
  copy:
    src: "{{ inventory_dir }}/files/root_ca.crt"
    dest: "/usr/local/share/ca-certificates/step-ca/step-ca.crt"
  when: acme_sh_server is defined

- name: run update-ca-certificates
  command: /usr/sbin/update-ca-certificates
  args:
    creates: /etc/ssl/certs/step-ca.pem
  when: acme_sh_server is defined

- name: normalize website definitions
  set_fact:
    _websites: >-
      {%- set out = [] -%}
      {%- for name, cfg in (websites | default({}, true)).items() -%}
      {%-   set c = website_site_defaults | combine(cfg | default({}, true), {'domain': name}) -%}
      {%-   set a = c.aliases | default([], true) -%}
      {%-   set c = c | combine({'aliases': [a] if a is string else a | list}) -%}
      {%-   set _ = out.append(c) -%}
      {%- endfor -%}
      {{ out }}
    _website_without_cert: []

- name: create docroot
  file:
    path: "{{ site.docroot }}"
    owner: root
    group: root
    mode: '0755'
    state: directory
  loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
  loop_control:
    loop_var: site
    label: "{{ site.domain }}"

- name: generate http vhost
  template:
    src: apache.conf.j2
    dest: /etc/apache2/sites-available/{{ site.domain }}.conf
    owner: root
    group: root
    mode: "0644"
  loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
  loop_control:
    loop_var: site
    label: "{{ site.domain }}"
  notify:
    - reload apache2

- name: activate http vhost
  file:
    state: link
    src: /etc/apache2/sites-available/{{ site.domain }}.conf
    dest: /etc/apache2/sites-enabled/{{ site.domain }}.conf
  loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
  loop_control:
    loop_var: site
    label: "{{ site.domain }}"
  notify:
    - reload apache2

# http vhosts must be live before acme.sh uses the webroot
- name: Flush handlers
  meta: flush_handlers

- name: certificate and ssl vhost
  include_tasks: ssl.yml
  loop: "{{ _websites | selectattr('state', 'eq', 'present') | list }}"
  loop_control:
    loop_var: site
    label: "{{ site.domain }}"

- name: remove websites
  include_tasks: absent.yml
  loop: "{{ _websites | selectattr('state', 'eq', 'absent') | list }}"
  loop_control:
    loop_var: site
    label: "{{ site.domain }}"

- name: websites without certificate (domain does not reach this host)
  debug:
    msg: "WARNING: no certificate and no ssl vhost for {{ _website_without_cert | join(', ') }} - check DNS and port 80, then rerun"
  when: _website_without_cert | length > 0
  failed_when: website_fail_without_cert | bool