#
#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

---
# - name: yum update
#   yum: name=* state=latest

# Install Mysql
- name: install epel release
  yum: name=epel-release state=present
  become_user: root

- name: install pip
  yum: name=python-pip state=latest update_cache=yes
  become_user: root

- name: install pexpect
  pip: name=pexpect
  become_user: root

# - name: Adds Python MySQL support on Debian/Ubuntu
#   apt: pkg="python-mysqldb" state=present
#   when: ansible_os_family == 'Debian'

- name: Adds Python MySQL support on RedHat/CentOS
  yum: name=MySQL-python state=present
  become_user: root
  # when: ansible_os_family == 'RedHat'

- name: Add MariaDB yum repository on CentOS
  copy: src="MariaDB_yum_CentOS_{{ ansible_distribution_major_version }}.repo"
        dest="/etc/yum.repos.d/"
  become_user: root
  when: ansible_distribution == 'CentOS'

- name: install mariadb
  yum: name="{{ item }}" state=latest update_cache=yes
  with_items: "{{ mysql_packages }}"
  become_user: root
#" for vim

- name: check if mysql has been updated
  stat: path=/usr/share/mysql/SELinux/mariadb.pp
  register: mysql_selinux_update

- debug:
    var: mysql_selinux_update

- name: double check policycoreutils installed
  yum: name=policycoreutils-python state=installed
  when: mysql_selinux_update.stat.exists == False
  become_user: root

- name: Copy SELinux type enforcement file
  copy: src=mysql-tmp.te dest=/tmp/
  when: mysql_selinux_update.stat.exists == False

- name: Compile SELinux module file
  command: checkmodule -M -m -o /tmp/mysql-tmp.mod /tmp/mysql-tmp.te
  when: mysql_selinux_update.stat.exists == False

- name: Build SELinux policy package
  command: semodule_package -o /tmp/mysql-tmp.pp -m /tmp/mysql-tmp.mod
  when: mysql_selinux_update.stat.exists == False

#- name: check if mysql has been updated
#  stat: path=/tmp/mysql-tmp.pp
#  register: mysql_pp
#
#- debug:
#    var: mysql_pp

- name: unLoad SELinux policy package
  command: semodule -r mysql-tmp
  when: mysql_selinux_update.stat.exists == False
  become_user: root
  ignore_errors: True

- name: Load SELinux policy package
  command: semodule -i /tmp/mysql-tmp.pp
  when: mysql_selinux_update.stat.exists == False
  become_user: root

- name: Remove temporary files
  file: path=/tmp/mysql-tmp.* state=absent
  when: mysql_selinux_update.stat.exists == False

# TODO: SELinux issue for 10.0.29 MariaDB, need to allow setgid/setuid.
## See https://www.rootusers.com/how-to-fix-mariadb-10-0-29-selinux-update-failure/
# and https://jira.mariadb.org/browse/MDEV-11789
# For now I'm not adding to Ansible script since this bug should be fixed in next MariaDB release
- name: start mariadb
  service: name=mysql state=started enabled=yes
  become_user: root

- include: secure_install.yml

- name: create databases
  mysql_db: name="{{ item }}" state=present encoding=utf8
  with_items:
    - "{{ mysql_databases }}"

- name: give access to {{ db_user }} from remote
  mysql_user: name="{{ db_user }}" password="{{ db_password }}" host="{{ hostvars[item]['ansible_default_ipv4']['address'] }}"
  with_items:
    - "{{ groups['api-orch'] }}"
    - "localhost"

# TODO: database access from GFac is no longer needed (GFac deprecated and only using Registry API)
- name: give access to {{ db_user }} from remote
  mysql_user: name="{{ db_user }}" password="{{ db_password }}" host="{{ hostvars[item]['ansible_default_ipv4']['address'] }}"
  with_items:
    - "{{ groups['gfac'] }}"
  when: "'gfac' in groups"

- name: create new user {{ db_user }} with all privilege
  mysql_user: name="{{ db_user }}"
              password="{{ db_password }}"
              append_privs=yes
              host_all=yes
              priv=*.*:ALL,GRANT state=present

- include: keycloak.yml
  when: "'keycloak' in groups"

- name: open firewall port {{ db_server_port }}
  firewalld: port="{{ db_server_port }}/tcp"
             zone=public permanent=true state=enabled immediate=yes
  become_user: root
