---
collections:
  - name: bodsch.core
    # version: ">=2.8.x"

- name: install collabora package via aur
  become: true
  become_user: aur_builder
  bodsch.core.aur:
    state: present
    name: collabora-online-server
    repository: "{{ collabora_arch.source_repository }}"
  async: 3200
  poll: 10
  register: _collabora_installed

- name: detect ansible check_mode
  bodsch.core.check_mode:
  register: _check_mode

- name: define check_mode
  ansible.builtin.set_fact:
    check_mode: '{{ _check_mode.check_mode }}'

- name: deploy and activate logstream_exporter version {{ logstream_exporter_version }}
  bodsch.core.deploy_and_activate:
    src_dir: "{{ logstream_exporter_local_tmp_directory }}"
    install_dir: "{{ logstream_exporter_install_path }}"
    link_dir: "/usr/bin"
    remote_src: false # "{{ 'true' if logstream_exporter_direct_download else 'false' }}"
    owner: "{{ logstream_exporter_system_user }}"
    group: "{{ logstream_exporter_system_group }}"
    mode: "0755"
    items:
      - name: "{{ logstream_exporter_release.binary }}"
        capability: "cap_net_raw+ep"
  notify:
    - restart logstream exporter

- name: initialize easy-rsa - (this is going to take a long time)
  bodsch.core.easyrsa:
    pki_dir: '{{ openvpn_easyrsa.directory }}/pki'
    req_cn_ca: "{{ openvpn_certificate.req_cn_ca }}"
    req_cn_server: '{{ openvpn_certificate.req_cn_server }}'
    ca_keysize: 4096
    dh_keysize: "{{ openvpn_diffie_hellman_keysize }}"
    working_dir: '{{ openvpn_easyrsa.directory }}'
    force: true
  register: _easyrsa_result

- name: create custom facts
  bodsch.core.facts:
    state: present
    name: icinga2
    facts:
      version: "2.10"
      salt: fgmklsdfnjyxnvjksdfbkuser
      user: icinga2

- name: create or revoke client certificate
  bodsch.core.openvpn_client_certificate:
    clients:
      - name: molecule
        state: present
        roadrunner: false
        static_ip: 10.8.3.100
        remote: server
        port: 1194
        proto: udp
        device: tun
        ping: 20
        ping_restart: 45
        cert: molecule.crt
        key: molecule.key
        tls_auth:
          enabled: true
      - name: roadrunner_one
        state: present
        roadrunner: true
        static_ip: 10.8.3.10
        remote: server
        port: 1194
        proto: udp
        device: tun
        ping: 20
        ping_restart: 45
        cert: roadrunner_one.crt
        key: roadrunner_one.key
        tls_auth:
          enabled: true
    working_dir: /etc/easy-rsa

- name: Check CRL status and include revoked certificates
  bodsch.core.openvpn_crl:
    state: status
    pki_dir: /etc/easy-rsa/pki
    list_revoked_certificates: true

- name: Warn if CRL expires within 14 days
  bodsch.core.openvpn_crl:
    state: status
    pki_dir: /etc/easy-rsa/pki
    warn_for_expire: true
    expire_in_days: 14
  register: crl_status

- name: Regenerate (renew) CRL using Easy-RSA
  bodsch.core.openvpn_crl:
    state: renew
    pki_dir: /etc/easy-rsa/pki
    working_dir: /etc/easy-rsa
  register: crl_renew

- name: Force recreation of an existing .ovpn file
  bodsch.core.openvpn_ovpn:
    state: present
    username: carol
    destination_directory: /etc/openvpn/clients
    force: true

- name: Print parsed version
  ansible.builtin.debug:
    msg: "OpenVPN version: {{ openvpn.version }}"

- name: Generate tls-auth key (ta.key)
  bodsch.core.openvpn:
    state: genkey
    secret: /etc/openvpn/ta.key

- name: Generate tls-auth key only if marker does not exist
  bodsch.core.openvpn:
    state: genkey
    secret: /etc/openvpn/ta.key
    creates: /var/lib/openvpn/ta.key.created

- name: Force regeneration by removing marker first
  bodsch.core.openvpn:
    state: genkey
    secret: /etc/openvpn/ta.key
    creates: /var/lib/openvpn/ta.key.created
    force: true

- name: Create Easy-RSA client and write inline .ovpn
  bodsch.core.openvpn:
    state: create_user
    secret: /dev/null              # required by module interface, not used here
    username: alice
    destination_directory: /etc/openvpn/clients
    chdir: /etc/easy-rsa

- name: Create user only if marker does not exist
  bodsch.core.openvpn:
    state: create_user
    secret: /dev/null
    username: bob
    destination_directory: /etc/openvpn/clients
    chdir: /etc/easy-rsa
    creates: /var/lib/openvpn/clients/bob.created

- name: get version of available package
  bodsch.core.package_version:
    package_name: nano
  register: package_version

- name: create pip requirements file
  bodsch.core.pip_requirements:
    name: docker
    state: present
    requirements:
      - name: docker
        compare_direction: "=="
        version: 6.0.0

      - name: setuptools
        version: 39.1.0

      - name: requests
        versions:
          - ">= 2.28.0"
          - "< 2.30.0"
          - "!~ 1.1.0"
  register: pip_requirements

---
- name: remove older ansible backup files
  bodsch.core.remove_ansible_backups:
    path: /etc
    holds: 4

- name: syncronize config for first run
  bodsch.core.sync_directory:
    source_directory: "{{ nextcloud_install_base_directory }}/nextcloud/{{ nextcloud_version }}/config_DIST"
    destination_directory: "{{ nextcloud_install_base_directory }}/nextcloud/config"
    arguments:
      verbose: true
      purge: false

- name: detect config version
  bodsch.core.syslog_cmd:
    parameters:
      - --version
  when:
    - not running_in_check_mode
  register: _syslog_config_version

- name: validate syslog-ng config
  bodsch.core.syslog_cmd:
    parameters:
      - --syntax-only
  check_mode: true

- name: Manage bash aliases/functions for many users in one task
  become: true
  bodsch.core.bash_aliases:
    state: present
    backup: true
    fail_on_error: true
    common_aliases:
      - alias: ll
        command: "ls -lah"
    users:
      - name: alice
        aliases:
          - alias: foo
            command: "echo 'foo'"
        functions:
          - name: mkcd
            content: |
              mkdir -p "$1" && cd "$1"
      - name: bob
        manage_bashrc: true
        aliases: []
        functions: []

- name: Collect file information for multiple paths
  bodsch.core.find_files:
    file_list:
      - /etc/passwd
      - /etc/shadow
      - /does/not/exist
      
- name: Use SHA-512 for checksums
  bodsch.core.find_files:
    names:
      - /etc/hosts
      - /etc/resolv.conf
    get_checksum: true
    checksum_algorithm: sha512

from ansible_collections.bodsch.php.plugins.module_utils.atomic_file import AtomicFileWriter

try:
    with AtomicFileWriter(
        destination=data_file,
        mode="w",
        encoding="utf-8",
    ) as file_handle:
        file_handle.write(data)

    exists = data_path.exists()

    if not exists:
        raise OSError(
            f"Atomic write reported success, but destination is missing: {data_file}"
        )

    os.chmod(data_file, 0o0664)

except (FileNotFoundError, NotADirectoryError, PermissionError, OSError) as exc:
    self.module.log(f"ERROR: Atomic file write failed: {exc}")
    raise

- name: Create custom directory tree
  bodsch.core.directories:
    base_path: /srv/app
    owner: appuser
    group: appgroup
    mode: "0775"
    paths:
      - path: data/cache          # → /srv/app/data/cache  (global owner/group/mode)
        owner: cacheuser          # owner override
        mode: "0770"
      - path: /opt/shared         # → /opt/shared          (absolute, global defaults)
      - path: tmp                 # → /srv/app/tmp
        mode: "0700"
      - path: /var/log/myapp      # → /var/log/myapp
        owner: syslog
        group: adm
        mode: "0750"

- name: create vaultwarden custom directory tree
  when:
    - not running_in_check_mode
  bodsch.core.directories:
    owner: vaultwarden
    group: vaultwarden
    mode: "0775"
    base_path: "{{ vaultwarden_config.directories.data }}"
    paths:
      - path: icon_cache
      - path: attachments
      - path: sends
      - path: tmp
      - path: templates