- name: install icinga web and apache packages
  ansible.builtin.apt:
    name:
      - apache2
      - icingaweb2
      - libapache2-mod-php8.2
      - php8.2-curl
      - php8.2-gd
      - php8.2-intl
      - php8.2-mbstring
      - php8.2-mysql
      - php8.2-xml
    state: present
    update_cache: true

- name: ensure apache2 is enabled and started
  ansible.builtin.service:
    name: apache2
    enabled: true
    state: started

- name: add web and monitoring users to icingaweb2 group
  ansible.builtin.user:
    name: "{{ item }}"
    groups: icingaweb2
    append: true
  loop:
    - www-data
    - nagios

- name: ensure icingaweb2 database exists
  ansible.builtin.shell: |
    mysql --socket={{ life_noc_db_root_socket }} -Nse "CREATE DATABASE IF NOT EXISTS {{ life_noc_db_web_name }} CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;"
  changed_when: false

- name: ensure icingaweb2 database user exists and has grants
  ansible.builtin.shell: |
    mysql --socket={{ life_noc_db_root_socket }} -Nse "GRANT SELECT, INSERT, UPDATE, DELETE, DROP, CREATE VIEW, INDEX, EXECUTE ON {{ life_noc_db_web_name }}.* TO '{{ life_noc_db_web_user }}'@'localhost' IDENTIFIED BY '{{ life_noc_db_web_password }}'; FLUSH PRIVILEGES;"
  changed_when: false

- name: check whether icingaweb2 schema is already imported
  ansible.builtin.shell: |
    mysql --socket={{ life_noc_db_root_socket }} -Nse "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='{{ life_noc_db_web_name }}' AND table_name='icingaweb_user';"
  register: life_noc_web_schema_check
  changed_when: false

- name: import icingaweb2 schema
  ansible.builtin.shell: |
    mysql --socket={{ life_noc_db_root_socket }} {{ life_noc_db_web_name }} < /usr/share/icingaweb2/schema/mysql.schema.sql
  args:
    executable: /bin/bash
  when: life_noc_web_schema_check.stdout | trim == '0'

- name: generate icingaweb2 admin password hash
  ansible.builtin.command: >-
    php -r 'echo password_hash(getenv("LIFE_NOC_ADMIN_PASSWORD"), PASSWORD_DEFAULT);'
  environment:
    LIFE_NOC_ADMIN_PASSWORD: "{{ life_noc_admin_password }}"
  register: life_noc_admin_password_hash
  changed_when: false
  no_log: true

- name: ensure icingaweb2 admin user exists with expected password
  ansible.builtin.shell: |
    mysql --socket={{ life_noc_db_root_socket }} {{ life_noc_db_web_name }} <<'SQL'
    INSERT INTO icingaweb_user (name, active, password_hash)
    VALUES ('{{ life_noc_admin_user }}', 1, '{{ life_noc_admin_password_hash.stdout }}')
    ON DUPLICATE KEY UPDATE
      active = VALUES(active),
      password_hash = VALUES(password_hash);
    SQL
  no_log: true

- name: ensure icingaweb2 config directories exist
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    owner: root
    group: icingaweb2
    mode: "{{ item.mode }}"
  loop:
    - { path: '/etc/icingaweb2', mode: '2770' }
    - { path: '/etc/icingaweb2/enabledModules', mode: '2770' }
    - { path: '/etc/icingaweb2/modules', mode: '2770' }
    - { path: '/etc/icingaweb2/modules/monitoring', mode: '2770' }
    - { path: '/etc/icingaweb2/preferences', mode: '2770' }

- name: deploy icingaweb2 core configuration
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: icingaweb2
    mode: "0660"
  loop:
    - { src: 'config.ini.j2', dest: '/etc/icingaweb2/config.ini' }
    - { src: 'resources.ini.j2', dest: '/etc/icingaweb2/resources.ini' }
    - { src: 'authentication.ini.j2', dest: '/etc/icingaweb2/authentication.ini' }
    - { src: 'roles.ini.j2', dest: '/etc/icingaweb2/roles.ini' }
  notify: restart apache2

- name: deploy monitoring module configuration
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: icingaweb2
    mode: "0660"
  loop:
    - { src: 'backends.ini.j2', dest: '/etc/icingaweb2/modules/monitoring/backends.ini' }
    - { src: 'commandtransports.ini.j2', dest: '/etc/icingaweb2/modules/monitoring/commandtransports.ini' }
  notify: restart apache2

- name: enable icingaweb2 modules
  ansible.builtin.command: "icingacli module enable {{ item }}"
  args:
    creates: "/etc/icingaweb2/enabledModules/{{ item }}"
  loop:
    - monitoring
    - doc
  notify: restart apache2