# SPDX-License-Identifier: MIT
---
- name: Set platform/version specific variables
  include_tasks: set_vars.yml

- name: Enable package repositories
  include_tasks: enable-package-repositories.yml
  when:
    - ha_cluster_enable_repos

- name: Install role essential packages
  package:
    name: "{{
      __ha_cluster_role_essential_packages
      +
      ha_cluster_extra_packages }}"
    state: "{{ 'latest' if ha_cluster_use_latest_packages else 'present' }}"
    use: "{{ (__ha_cluster_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"

- name: Preconfigure hosts
  when:
    - ha_cluster_cluster_present is not none or ha_cluster_qnetd is not none
  block:
    - name: Check and prepare role variables
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/check-and-prepare-role-variables.yml  # yamllint disable-line rule:line-length

    # The user is created by installing pacemaker packages. We just need to set
    # the password.
    - name: Provide a password for the hacluster user
      when:
        - ha_cluster_hacluster_password | string | length > 0
      block:
        - name: Generate a password hash
          # The arg `-6` means SHA512 based algorithms.
          command:
            cmd: >-
              openssl passwd
                -6
                -salt {{ ansible_hostname.replace('-', 'x') | quote }}
                {{ ha_cluster_hacluster_password | string | quote }}
          register: __ha_cluster_openssl_call_result
          changed_when: false
          no_log: true

        - name: Set hacluster password
          user:
            name: hacluster
            password: "{{ __ha_cluster_openssl_call_result.stdout }}"

    - name: Configure shell
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/configure-shell.yml

    - name: Configure firewall and selinux
      when: ha_cluster_cluster_present | bool or ha_cluster_qnetd.present | d(false)  # yamllint disable-line rule:line-length
      block:
        - name: Configure firewall
          include_tasks: firewall.yml

        - name: Configure selinux
          include_tasks: selinux.yml

- name: Install and configure HA cluster
  when: ha_cluster_cluster_present | bool
  block:
    - name: Install cluster packages
      package:
        name: "{{
          __ha_cluster_fullstack_node_packages
          +
          __ha_cluster_qdevice_in_use |
            ternary(__ha_cluster_qdevice_node_packages, [])
          +
          ha_cluster_sbd_enabled | ternary(__ha_cluster_sbd_packages, [])
          +
          ha_cluster_install_cloud_agents |
            ternary(__ha_cluster_cloud_agents_packages[ansible_architecture]
                | d(__ha_cluster_cloud_agents_packages['noarch'] | d([])),
              [])
          +
          ha_cluster_fence_agent_packages }}"
        state: "{{ 'latest' if ha_cluster_use_latest_packages else 'present' }}"
        use: "{{ (__ha_cluster_is_ostree | d(false)) |
                 ternary('ansible.posix.rhel_rpm_ostree', omit) }}"

    - name: Distribute fence-virt authkey
      include_tasks: distribute-fence-virt-key.yml
      when:
        - ansible_architecture == "x86_64"

    - name: Configure SBD
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/sbd.yml

    - name: Configure corosync
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/cluster-setup-corosync.yml  # yamllint disable-line rule:line-length

    - name: Cluster auth
      # Auth is run after corosync.conf has been distributed so that pcs
      # distributes pcs tokens in the cluster automatically.
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/cluster-auth.yml

    - name: Distribute cluster shared keys
      # This is run after pcs auth, so that the nodes are authenticated against
      # a qnetd host, if configured, and can connect to the qnetd host's pcsd
      # to get qnetd certificates.
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/cluster-setup-keys.yml  # yamllint disable-line rule:line-length

    - name: Enable or disable cluster services on boot
      include_tasks: shell_common/cluster-enable-disable.yml

    - name: Start the cluster and reload corosync.conf
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/cluster-start-and-reload.yml  # yamllint disable-line rule:line-length

    - name: Create and push CIB
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/create-and-push-cib.yml  # yamllint disable-line rule:line-length
      # CIB changes should be done only on one of cluster nodes to avoid
      # corruption and inconsistency of resulting cibadmin patch file.
      run_once: true

- name: Remove cluster configuration
  when:
    - ha_cluster_cluster_present is not none
    - not ha_cluster_cluster_present
  block:
    - name: Remove cluster configuration
      include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/cluster-destroy-{{ __ha_cluster_pcs_provider }}.yml  # yamllint disable-line rule:line-length

    - name: Remove fence-virt authkey
      file:
        path: /etc/cluster/fence_xvm.key
        state: absent

- name: Configure qnetd
  when: ha_cluster_qnetd is not none
  include_tasks: shell_{{ ha_cluster_pacemaker_shell }}/pcs-qnetd.yml

- name: Export configuration
  when:
    - ha_cluster_export_configuration | bool
    - ha_cluster_pacemaker_shell == "pcs"
  block:
    - name: Fetch configuration
      ha_cluster_info:
      register: __ha_cluster_info

    - name: Set configuration fact
      set_fact:
        ha_cluster_facts: "{{ __ha_cluster_info.ha_cluster }}"
