---
- name: Exiger le mot de passe admin LDAP (Vault)
  ansible.builtin.assert:
    that:
      - serveur_openldap_admin_password | length > 0
    fail_msg: "serveur_openldap_admin_password est requis (a fournir via Ansible Vault)."

- name: Installer debconf-utils (requis par le module debconf, fournit debconf-get-selections)
  ansible.builtin.apt:
    name: debconf-utils
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Preconfigurer slapd (debconf)
  ansible.builtin.debconf:
    name: slapd
    question: "{{ item.question }}"
    vtype: "{{ item.vtype }}"
    value: "{{ item.value }}"
  loop:
    - { question: "slapd/no_configuration", vtype: "boolean", value: "false" }
    - { question: "slapd/domain", vtype: "string", value: "{{ serveur_openldap_domaine }}" }
    - { question: "shared/organization", vtype: "string", value: "{{ serveur_openldap_organisation }}" }
    - { question: "slapd/backend", vtype: "select", value: "MDB" }
    - { question: "slapd/purge_database", vtype: "boolean", value: "true" }
    - { question: "slapd/move_old_database", vtype: "boolean", value: "true" }
    - { question: "slapd/allow_ldap_v2", vtype: "boolean", value: "false" }
  loop_control:
    label: "{{ item.question }}"

- name: Preconfigurer le mot de passe admin slapd (debconf)
  ansible.builtin.debconf:
    name: slapd
    question: "{{ item }}"
    vtype: password
    value: "{{ serveur_openldap_admin_password }}"
  loop:
    - slapd/password1
    - slapd/password2
  no_log: true

- name: Installer OpenLDAP
  ansible.builtin.apt:
    name: "{{ serveur_openldap_paquets }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Activer et demarrer slapd
  when: not ansible_check_mode
  ansible.builtin.systemd:
    name: "{{ serveur_openldap_service }}"
    enabled: true
    state: started

- name: Creer les unites organisationnelles de base
  community.general.ldap_entry:
    dn: "ou={{ item }},{{ serveur_openldap_base_dn }}"
    objectClass: organizationalUnit
    server_uri: "ldapi:///"
    bind_dn: "{{ serveur_openldap_admin_dn }}"
    bind_pw: "{{ serveur_openldap_admin_password }}"
  loop: "{{ serveur_openldap_ou }}"
  loop_control:
    label: "ou={{ item }}"
  no_log: true

# --- TLS (LDAPS + STARTTLS) via le certificat step_ca depose par client_pki ---
- name: TLS — creer le repertoire pont lisible par openldap
  ansible.builtin.file:
    path: "{{ serveur_openldap_tls_dir }}"
    state: directory
    owner: openldap
    group: openldap
    mode: "0750"
  when: serveur_openldap_tls_actif | bool

- name: TLS — deployer le script de synchronisation du certificat
  ansible.builtin.template:
    src: setops-slapd-cert-sync.sh.j2
    dest: /usr/local/sbin/setops-slapd-cert-sync
    owner: root
    group: root
    mode: "0755"
  when: serveur_openldap_tls_actif | bool

- name: TLS — deployer les unites de synchronisation (service + path)
  ansible.builtin.template:
    src: "{{ item.s }}"
    dest: "{{ item.d }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - { s: "setops-slapd-cert-sync.service.j2", d: "/etc/systemd/system/setops-slapd-cert-sync.service" }
    - { s: "setops-slapd-cert-sync.path.j2", d: "/etc/systemd/system/setops-slapd-cert-sync.path" }
  loop_control:
    label: "{{ item.d | basename }}"
  when: serveur_openldap_tls_actif | bool

- name: TLS — synchroniser le certificat maintenant (si client_pki l'a depose)
  ansible.builtin.command: /usr/local/sbin/setops-slapd-cert-sync
  changed_when: false
  when:
    - serveur_openldap_tls_actif | bool
    - not ansible_check_mode

- name: TLS — activer la surveillance du certificat (renouvellement)
  ansible.builtin.systemd:
    name: setops-slapd-cert-sync.path
    enabled: true
    state: started
    daemon_reload: true
  when:
    - serveur_openldap_tls_actif | bool
    - not ansible_check_mode

- name: TLS — verifier que le certificat pont est en place
  ansible.builtin.stat:
    path: "{{ serveur_openldap_tls_dir }}/cert.pem"
  register: serveur_openldap_cert_pont
  when: serveur_openldap_tls_actif | bool

- name: TLS — avertir si le certificat n'est pas encore disponible
  ansible.builtin.debug:
    msg: >-
      client_pki n'a pas encore depose de certificat sur ce noeud
      ({{ serveur_openldap_tls_source_cert }}). TLS slapd NON configure : deploie
      l'integration client_pki sur ce noeud, puis relance le deploiement.
  when:
    - serveur_openldap_tls_actif | bool
    - not ansible_check_mode
    - not (serveur_openldap_cert_pont.stat.exists | default(false))

- name: TLS — configurer slapd (olcTLS* dans cn=config)
  community.general.ldap_attrs:
    dn: cn=config
    server_uri: ldapi:///
    attributes:
      olcTLSCACertificateFile: "{{ serveur_openldap_tls_dir }}/ca.pem"
      olcTLSCertificateFile: "{{ serveur_openldap_tls_dir }}/cert.pem"
      olcTLSCertificateKeyFile: "{{ serveur_openldap_tls_dir }}/key.pem"
    state: exact
  when:
    - serveur_openldap_tls_actif | bool
    - not ansible_check_mode
    - serveur_openldap_cert_pont.stat.exists | default(false)
  notify: Redemarrer slapd

- name: TLS — exposer LDAPS (SLAPD_SERVICES)
  ansible.builtin.lineinfile:
    path: /etc/default/slapd
    regexp: '^SLAPD_SERVICES='
    line: 'SLAPD_SERVICES="{{ serveur_openldap_services }}"'
  when:
    - serveur_openldap_tls_actif | bool
    - serveur_openldap_cert_pont.stat.exists | default(false)
  notify: Redemarrer slapd