# SPDX-License-Identifier: MIT
---
# In newer pcs versions, /var/lib/pcsd is created by systemd when pcsd starts.
# In older versions, it is created during installation. At this point, the
# directory may not exist yet, but this role needs it. We ensure it exists;
# systemd will fix its permissions if needed. Using a different path is not
# supported, as all supported configs use /var/lib/pcsd.
- name: Ensure /var/lib/pcsd exists
  file:
    path: /var/lib/pcsd
    state: directory
    owner: root
    group: root
    mode: "0700"

# Pcsd must be stopped when its config files are being updated. This is to
# prevent a race condition caused by pcsd syncing its files in the cluster on
# its own.
- name: Stop pcsd
  service:
    name: pcsd
    state: stopped

- name: Regenerate pcsd TLS certificate and key
  # pcsd will generate a certificate - key pair once it is started
  file:
    path: "{{ item }}"
    state: absent
  loop:
    - /var/lib/pcsd/pcsd.key
    - /var/lib/pcsd/pcsd.crt
  when:
    - ha_cluster_regenerate_keys

- name: Create pcsd certificate and private_key files
  when: ha_cluster_pcsd_certificates | length > 0
  block:
    - name: Get the stat of /var/lib/pcsd
      stat:
        path: /var/lib/pcsd
      register: __pcsd_stat

    - name: Allow certmonger to write into pcsd's certificate directory
      file:
        path: /var/lib/pcsd
        state: directory
        setype: cert_t
        mode: "{{ __pcsd_stat.stat.mode }}"

    - name: >-
       Ensure the name of ha_cluster_pcsd_certificates is /var/lib/pcsd/pcsd;
       Create certificates using the certificate role
      include_role:
        name: fedora.linux_system_roles.certificate
      vars:
        certificate_requests: "{{ ha_cluster_pcsd_certificates |
          map('combine', {'name': '/var/lib/pcsd/pcsd'}) | list }}"
  always:
    - name: Set pcsd's certificate directory back to cluster_var_lib_t
      file:
        path: /var/lib/pcsd
        state: directory
        setype: cluster_var_lib_t
        mode: "{{ __pcsd_stat.stat.mode }}"

- name: Distribute pcsd TLS certificate and key
  when:
    - ha_cluster_pcsd_certificates | length == 0
    - ha_cluster_pcsd_public_key_src is string
    - ha_cluster_pcsd_public_key_src | length > 0
    - ha_cluster_pcsd_private_key_src is string
    - ha_cluster_pcsd_private_key_src | length > 0
  block:
    - name: Distribute pcsd TLS private key
      copy:
        src: "{{ ha_cluster_pcsd_private_key_src }}"
        dest: /var/lib/pcsd/pcsd.key
        owner: root
        group: root
        mode: "0600"
    - name: Distribute pcsd TLS certificate
      copy:
        src: "{{ ha_cluster_pcsd_public_key_src }}"
        dest: /var/lib/pcsd/pcsd.crt
        owner: root
        group: root
        mode: "0600"

- name: Distribute pcs_settings.conf
  template:
    src: templates/pcs_settings.conf
    dest: /var/lib/pcsd/pcs_settings.conf
    owner: root
    group: root
    mode: "0644"
    trim_blocks: false

- name: Start pcsd with updated config files and configure it to start on boot
  service:
    name: pcsd
    state: started
    enabled: true
