---
# Copyright 2014, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: Create keystone dir
  file:
    path: "{{ item.path }}"
    state: directory
    owner: "{{ item.owner|default(keystone_system_user_name) }}"
    group: "{{ item.group|default(keystone_system_group_name) }}"
    mode: "{{ item.mode|default('0755') }}"
  with_items:
    - { path: "/etc/pki/tls/certs", owner: "root", group: "root" }
    - { path: "/etc/pki/tls/private", owner: "root", group: "root" }
    - { path: "/var/lock/keystone", mode: "2755" }
    - { path: "/var/log/httpd", mode: "2755" }
  when:
    - ansible_pkg_mgr in ['yum', 'dnf']

- name: Create system links
  file:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    state: "link"
  with_items:
    - { src: "/etc/pki/tls/certs", dest: "/etc/ssl/certs" }
    - { src: "/etc/pki/tls/private", dest: "/etc/ssl/private" }
    - { src: "/var/log/httpd", dest: "/var/log/apache2" }
  when:
    - ansible_pkg_mgr in ['yum', 'dnf']

- name: Add shibboleth repo
  yum_repository:
    name: "shibboleth"
    description: "shibboleth Repo"
    baseurl: "http://download.opensuse.org/repositories/security:/shibboleth/CentOS_7/"
    gpgkey: "http://download.opensuse.org/repositories/security:/shibboleth/CentOS_7//repodata/repomd.xml.key"
    gpgcheck: yes
  when:
    - ansible_pkg_mgr in ['yum', 'dnf']
    - keystone_sp != {}

- name: Add NGINX repository
  yum_repository:
    name: nginx
    description: 'nginx repo'
    baseurl: "{{ keystone_nginx_repo }}"
    gpgkey: "{{ keystone_nginx_gpg_key }}"
  when:
    - ansible_pkg_mgr in ['yum', 'dnf']
    - keystone_web_server == 'nginx'
  register: add_nginx_repo
  until: add_nginx_repo is success
  retries: 5
  delay: 2

# If the web server being removed was never installed, this task will fail when trying
# to stop/disable it. The task is therefore set to never fail.
- name: Ensure other web server is not running/enabled
  service:
    name: "{{ (keystone_web_server == 'nginx') | ternary(keystone_system_service_name, 'nginx') }}"
    enabled: no
    state: stopped
    daemon_reload: "yes"
  failed_when: false

- name: Remove other web server distro packages and mod_wsgi
  package:
    name: "{{ (keystone_web_server == 'nginx') | ternary(keystone_apache_distro_packages, keystone_nginx_distro_packages) }}"
    state: absent
    autoremove: "{{ (ansible_pkg_mgr == 'apt') | ternary('yes', omit) }}"

- name: Install distro packages
  package:
    name: "{{ keystone_package_list }}"
    state: "{{ keystone_package_state }}"
    update_cache: "{{ (ansible_pkg_mgr in ['apt', 'zypper']) | ternary('yes', omit) }}"
    cache_valid_time: "{{ (ansible_pkg_mgr == 'apt') | ternary(cache_timeout, omit) }}"
  register: install_packages
  until: install_packages is success
  retries: 5
  delay: 2
  notify:
    - Manage LB
    - Restart web server

- name: Install keystone packages from PIP
  include_tasks: keystone_install_source.yml
  when: keystone_install_method == 'source'

# TODO(hwoarang): We need to have a venv_tag local fact deployed since we use it in the
# integration repo to determine if keystone software is the same across all nodes in the
# keystone_all group so we can safely run the DB migration. See
# https://github.com/openstack/openstack-ansible/blob/master/playbooks/os-keystone-install.yml
- name: Record the venv tag deployed
  ini_file:
    dest: "/etc/ansible/facts.d/openstack_ansible.fact"
    section: keystone
    option: venv_tag
    value: "{{ keystone_venv_tag }}"

- name: Initialise the upgrade facts
  ini_file:
    dest: "/etc/ansible/facts.d/openstack_ansible.fact"
    section: keystone
    option: "{{ item.name }}"
    value: "{{ item.state }}"
  with_items:
    - name: "need_db_expand"
      state: "True"
    - name: "need_db_migrate"
      state: "True"
    - name: "need_db_contract"
      state: "True"
    - name: "install_method"
      state: "{{ keystone_install_method }}"
  when: (keystone_install_method == 'source' and
        (keystone_get_venv | changed or keystone_venv_dir | changed)) or
        (install_packages | changed) or
        (ansible_local is not defined) or
        ('openstack_ansible' not in ansible_local) or
        ('keystone' not in ansible_local['openstack_ansible']) or
        ('need_db_expand' not in ansible_local['openstack_ansible']['keystone']) or
        ('need_db_migrate' not in ansible_local['openstack_ansible']['keystone']) or
        ('need_db_contract' not in ansible_local['openstack_ansible']['keystone'])

- name: Create WSGI symlinks
  file:
    src: "{{ item.src }}"
    dest: "/var/www/cgi-bin/keystone/{{ item.dest }}"
    state: link
    force: yes
  with_items:
    - src: "{{ keystone_bin }}/keystone-wsgi-admin"
      dest: admin
    - src: "{{ keystone_bin }}/keystone-wsgi-public"
      dest: main
  notify:
    - Manage LB
    - Restart web server